On Wed, Nov 11, 2009 at 12:14:41PM +0000, Daniel P. Berrange wrote:
> When running qemu:///system instance, libvirtd runs as root,
> but QEMU may optionally be configured to run non-root. When
> then saving a guest to a state file, the file is initially
> created as root, and thus QEMU cannot write to it. It is also
> missing labelling required to allow access via SELinux.
>
> * src/qemu/qemu_driver.c: Set ownership on save image before
> running migrate command in virDomainSave impl. Call out to
> security driver to set save image labelling
> * src/security/security_driver.h: Add driver APIs for setting
> and restoring saved state file labelling
> * src/security/security_selinux.c: Implement saved state file
> labelling for SELinux
> ---
> src/qemu/qemu_driver.c | 35 ++++++++++++++++++++++++++++++++---
> src/security/security_driver.h | 7 +++++++
> src/security/security_selinux.c | 23 +++++++++++++++++++++++
> 3 files changed, 62 insertions(+), 3 deletions(-)
>
> diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c
> index 30003e6..b023902 100644
[...]
> + if (driver->privileged &&
> + chown(path, 0, 0) < 0) {
> + virReportSystemError(NULL, errno,
> + _("unable to set ownership of '%s' to user %d:%d"),
> + path, 0, 0);
> + goto endjob;
> + }
reusing qemuDomainSetFileOwnership() here would makes things a little
bit more readable I think, maybe qemuDomainSetFileOwnership error
message could be extended as provided there too,
But it's cosmetic, ACK in any case,
Daniel
--
Daniel Veillard | libxml Gnome XML XSLT toolkit http://xmlsoft.org/
daniel@xxxxxxxxxxxx | Rpmfind RPM search engine http://rpmfind.net/
http://veillard.com/ | virtualization library http://libvirt.org/
--
Libvir-list mailing list
Libvir-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/libvir-list