2008/4/21, Daniel Veillard <<a href="mailto:veillard@redhat.com">veillard@redhat.com</a>>:<div><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"> On Mon, Apr 21, 2008 at 01:06:02PM +0400, Anton Protopopov wrote: > 2008/4/17, Daniel Veillard <<a href="mailto:veillard@redhat.com">veillard@redhat.com</a>>: > > > > On Mon, Apr 14, 2008 at 07:37:56PM +0400, Anton Protopopov wrote: > > > Hi, > > > > > > Non-root can't use /var/run/libvirt/libvirt-sock even in the case > > > "unix_sock_group" and "unix_sock_rw_perms" are set properly. > > > > > > The reason: > > > # ls -l /var/run /var/run/libvirt | grep libvirt | grep -v pid > > > drwx------ 2 root root 4096 Apr 14 19:14 libvirt > > > srwxrwx--- 1 root libvirt 0 Apr 14 19:14 libvirt-sock > > > srwxrwxrwx 1 root libvirt 0 Apr 14 19:14 libvirt-sock-ro > > > > > > i.e., bad permissions on /var/run/libvirt > > > > > > Hum, how did you get this ? Maybe this is more a packaging problem than > > anything else > > > Yes, it was, sorry... So do you think the patch really make sense in a more general way. Except for the group from the configuration this looks like the wrong way to fix this. Do you agree ? If yes what about making a subset of the patch just for the socket group rights ? Daniel</blockquote><div> Well, I think that there were two decisions: First one is to change the permissions of /var/run/libvirt to 0750 (by spcifying it in spec) and then change the group ownership of this directory in main(), right after the call to remoteReadConfigFile(). That must be done in main() because one can set "unix_sock_group" to non-root and then remove config file. The other (simple) one is to leave it as is :) </div> If you want, I can make patch to fix the first case A. <blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"> -- Red Hat Virtualization group <a href="http://redhat.com/virtualization/">http://redhat.com/virtualization/</a> Daniel Veillard | virtualization library <a href="http://libvirt.org/">http://libvirt.org/</a> <a href="mailto:veillard@redhat.com">veillard@redhat.com</a> | libxml GNOME XML XSLT toolkit <a href="http://xmlsoft.org/">http://xmlsoft.org/</a> <a href="http://veillard.com/">http://veillard.com/</a> | Rpmfind RPM search engine <a href="http://rpmfind.net/">http://rpmfind.net/</a> </blockquote></div>