Re: [Libguestfs] [PATCH v2v v3] lib: Improve security of in/out sockets when running virt-v2v as root

2022-03-23 Thread Laszlo Ersek
On 03/22/22 22:21, Richard W.M. Jones wrote: > When using the libvirt backend and running as root, libvirt will run > qemu as a non-root user (eg. qemu:qemu). The v2v directory stores NBD > endpoints that qemu must be able to open and so we set the directory > to mode 0711. Unfortunately this

Re: [Libguestfs] [PATCH v2v v3] lib: Improve security of in/out sockets when running virt-v2v as root

2022-03-22 Thread Richard W.M. Jones
On Tue, Mar 22, 2022 at 09:21:26PM +, Richard W.M. Jones wrote: > +and libvirt_qemu_user () = > + let uid = > +lazy ( ... > +) in > + Lazy.force uid Bleah, this but without the obviously bogus use of lazy(). I've fixed this in my local copy. Rich. -- Richard Jones,

[Libguestfs] [PATCH v2v v3] lib: Improve security of in/out sockets when running virt-v2v as root

2022-03-22 Thread Richard W.M. Jones
When using the libvirt backend and running as root, libvirt will run qemu as a non-root user (eg. qemu:qemu). The v2v directory stores NBD endpoints that qemu must be able to open and so we set the directory to mode 0711. Unfortunately this permits any non-root user to open the sockets (since,