Re: [Libguestfs] [PATCH v2v v3] lib: Improve security of in/out sockets when running virt-v2v as root

2022-03-22 Thread Richard W.M. Jones
On Tue, Mar 22, 2022 at 09:21:26PM +, Richard W.M. Jones wrote: > +and libvirt_qemu_user () = > + let uid = > +lazy ( ... > +) in > + Lazy.force uid Bleah, this but without the obviously bogus use of lazy(). I've fixed this in my local copy. Rich. -- Richard Jones,

[Libguestfs] [PATCH v2v v3] lib: Improve security of in/out sockets when running virt-v2v as root

2022-03-22 Thread Richard W.M. Jones
When using the libvirt backend and running as root, libvirt will run qemu as a non-root user (eg. qemu:qemu). The v2v directory stores NBD endpoints that qemu must be able to open and so we set the directory to mode 0711. Unfortunately this permits any non-root user to open the sockets (since,

Re: [Libguestfs] [PATCH v2v v2] lib: Use an ACL to allow qemu to access the v2v directory

2022-03-22 Thread Richard W.M. Jones
On Tue, Mar 22, 2022 at 05:46:18PM +, Richard W.M. Jones wrote: > On Tue, Mar 22, 2022 at 05:34:25PM +0100, Laszlo Ersek wrote: > > Is it OK if we pass "+107" to "setfacl" here? > > Yes it works fine. The "+" is a surprise feature of getpwnam(3) in fact, > albeit one which doesn't appear to

Re: [Libguestfs] [PATCH v2v v2] lib: Use an ACL to allow qemu to access the v2v directory

2022-03-22 Thread Richard W.M. Jones
On Tue, Mar 22, 2022 at 05:34:25PM +0100, Laszlo Ersek wrote: > Is it OK if we pass "+107" to "setfacl" here? Yes it works fine. The "+" is a surprise feature of getpwnam(3) in fact, albeit one which doesn't appear to be documented in the man page. Rich. -- Richard Jones, Virtualization

Re: [Libguestfs] [PATCH v2v] lib: Use an ACL to allow qemu to access the v2v directory

2022-03-22 Thread Richard W.M. Jones
On Tue, Mar 22, 2022 at 05:10:07PM +0100, Laszlo Ersek wrote: > On 03/22/22 15:35, Richard W.M. Jones wrote: > > When using the libvirt backend and running as root, libvirt will run > > qemu as a non-root user (eg. qemu:qemu). The v2v directory stores NBD > > endpoints that qemu must be able to

Re: [Libguestfs] [PATCH v2v v2] lib: Use an ACL to allow qemu to access the v2v directory

2022-03-22 Thread Daniel P . Berrangé
On Tue, Mar 22, 2022 at 05:34:25PM +0100, Laszlo Ersek wrote: > On 03/22/22 16:48, Richard W.M. Jones wrote: > > When using the libvirt backend and running as root, libvirt will run > > qemu as a non-root user (eg. qemu:qemu). The v2v directory stores NBD > > endpoints that qemu must be able to

Re: [Libguestfs] [PATCH v2v v2] lib: Use an ACL to allow qemu to access the v2v directory

2022-03-22 Thread Laszlo Ersek
On 03/22/22 16:48, Richard W.M. Jones wrote: > When using the libvirt backend and running as root, libvirt will run > qemu as a non-root user (eg. qemu:qemu). The v2v directory stores NBD > endpoints that qemu must be able to open and so we set the directory > to mode 0711. Unfortunately this

Re: [Libguestfs] [PATCH v2v] lib: Use an ACL to allow qemu to access the v2v directory

2022-03-22 Thread Laszlo Ersek
On 03/22/22 15:51, Daniel P. Berrangé wrote: > On Tue, Mar 22, 2022 at 02:35:54PM +, Richard W.M. Jones wrote: >> For fuller explanation see: >> https://bugzilla.redhat.com/show_bug.cgi?id=2066773#c1 >> >> I'm not very happy with this patch for a few reasons: >> >> - Does every distro use

Re: [Libguestfs] [PATCH v2v] lib: Use an ACL to allow qemu to access the v2v directory

2022-03-22 Thread Laszlo Ersek
On 03/22/22 15:35, Richard W.M. Jones wrote: > When using the libvirt backend and running as root, libvirt will run > qemu as a non-root user (eg. qemu:qemu). The v2v directory stores NBD > endpoints that qemu must be able to open and so we set the directory > to mode 0711. Unfortunately this

[Libguestfs] [PATCH v2v v2] lib: Use an ACL to allow qemu to access the v2v directory

2022-03-22 Thread Richard W.M. Jones
When using the libvirt backend and running as root, libvirt will run qemu as a non-root user (eg. qemu:qemu). The v2v directory stores NBD endpoints that qemu must be able to open and so we set the directory to mode 0711. Unfortunately this permits any non-root user to open the sockets (since,

Re: [Libguestfs] [PATCH] spec: Add NBD_OPT_EXTENDED_HEADERS

2022-03-22 Thread Eric Blake
On Tue, Dec 07, 2021 at 06:14:23PM +0200, Wouter Verhelst wrote: > On Mon, Dec 06, 2021 at 05:00:47PM -0600, Eric Blake wrote: > > On Mon, Dec 06, 2021 at 02:40:45PM +0300, Vladimir Sementsov-Ogievskiy > > wrote: > > > > Simple reply message > > > > > > > > The simple reply message MUST

Re: [Libguestfs] [PATCH v2v] lib: Use an ACL to allow qemu to access the v2v directory

2022-03-22 Thread Daniel P . Berrangé
On Tue, Mar 22, 2022 at 02:35:54PM +, Richard W.M. Jones wrote: > For fuller explanation see: > https://bugzilla.redhat.com/show_bug.cgi?id=2066773#c1 > > I'm not very happy with this patch for a few reasons: > > - Does every distro use "qemu" as the user that runs qemu? Not sure, but you

[Libguestfs] [PATCH v2v] lib: Use an ACL to allow qemu to access the v2v directory

2022-03-22 Thread Richard W.M. Jones
When using the libvirt backend and running as root, libvirt will run qemu as a non-root user (eg. qemu:qemu). The v2v directory stores NBD endpoints that qemu must be able to open and so we set the directory to mode 0711. Unfortunately this permits any non-root user to open the sockets (since,

[Libguestfs] [PATCH v2v] lib: Use an ACL to allow qemu to access the v2v directory

2022-03-22 Thread Richard W.M. Jones
For fuller explanation see: https://bugzilla.redhat.com/show_bug.cgi?id=2066773#c1 I'm not very happy with this patch for a few reasons: - Does every distro use "qemu" as the user that runs qemu? - Having to run an external process (not a big deal, but a bit clumsy) - Aren't ACLs actually