2008/4/17, Daniel Veillard <<a href="mailto:veillard@redhat.com" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">veillard@redhat.com</a>>:<div><span class="gmail_quote"></span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
On Mon, Apr 14, 2008 at 07:37:56PM +0400, Anton Protopopov wrote:<br> > Hi,<br> ><br> > Non-root can't use /var/run/libvirt/libvirt-sock even in the case<br> > "unix_sock_group" and "unix_sock_rw_perms" are set properly.<br>
><br> > The reason:<br> > # ls -l /var/run /var/run/libvirt | grep libvirt | grep -v pid<br> > drwx------ 2 root root 4096 Apr 14 19:14 libvirt<br> > srwxrwx--- 1 root libvirt 0 Apr 14 19:14 libvirt-sock<br>
> srwxrwxrwx 1 root libvirt 0 Apr 14 19:14 libvirt-sock-ro<br> ><br> > i.e., bad permissions on /var/run/libvirt<br> <br> <br> Hum, how did you get this ? Maybe this is more a packaging problem than<br> anything else</blockquote>
<div><br>Yes, it was, sorry... <br><br></div><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">, I have this here:<br> <br> [root@paphio ~]# rpm -qf /var/run/libvirt<br>
libvirt-0.4.1-3.fc8<br> [root@paphio ~]# rpm -V libvirt<br> [root@paphio ~]# ls -ld /var/run/libvirt<br> drwxr-xr-x 2 root root 4096 2008-04-04 18:00 /var/run/libvirt<br> [root@paphio ~]# ls -l /var/run/libvirt<br> total 0<br>
srwxrwxrwx 1 root root 0 2008-03-29 14:56 libvirt-sock<br> srwxrwxrwx 1 root root 0 2008-03-29 14:56 libvirt-sock-ro<br> [root@paphio ~]#<br> <br><br> > One possible solution (implied in the attached patch) is the following:<br>
><br> > Every time libvirtd starts<br> > * it implicitly sets the group id of /var/run/libvirt:<br> > chown(/var/run/libvirt, -1, unix_sock_gid).<br> > * if "unix_sock_group" defined in /etc/libvirt/libvirtd.conf, libvirtd does<br>
> chmod g+x /var/run/libvirt<br> > otherwise,<br> > chmod g-x /var/run/libvirt<br> <br> <br> I don't know, that's doable too, but if there is a packaging problem<br> maybe it's good to have it fixed instead of changing permissions at<br>
runtime. But the configuration data should override this, that's true.<br> What do others think ?<br> <br> Daniel<br> <br><br> --<br> Red Hat Virtualization group <a href="http://redhat.com/virtualization/" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">http://redhat.com/virtualization/</a><br>
Daniel Veillard | virtualization library <a href="http://libvirt.org/" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">http://libvirt.org/</a><br> <a href="mailto:veillard@redhat.com" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">veillard@redhat.com</a> | libxml GNOME XML XSLT toolkit <a href="http://xmlsoft.org/" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">http://xmlsoft.org/</a><br>
<a href="http://veillard.com/" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">http://veillard.com/</a> | Rpmfind RPM search engine <a href="http://rpmfind.net/" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">http://rpmfind.net/</a><br>
</blockquote></div><br>