[Libvir] libvirt daemon UNIX socket auth with PolicyKit
Richard W.M. Jones
rjones at redhat.com
Wed Aug 8 15:02:25 UTC 2007
Daniel P. Berrange wrote:
> On Wed, Aug 08, 2007 at 03:42:30PM +0100, Richard W.M. Jones wrote:
>> Daniel P. Berrange wrote:
>> srw-rw---- 1 root virtstaff 0 2007-06-29 15:50
>> /var/run/libvirt/libvirt-sock
>
> That either gives a user full access without requiring any password, or
> requires that the app run as root. That's just a mild tweaking of the
> status quo. It doesn't allow us to authenticate a non-root user to allow
> them access without the app itself being run as root.
I wouldn't call it a "mild tweaking of the status quo". It lets an
administrator designate staff who are permitted to manage virtualization
(ie. by adding them to the virtstaff group), and then those staff can
run management programs as themselves (non-root). If typing in a
password is important because it proves that at the moment that the
program was started, then the staff member was sitting in front of the
computer (but not, like, later on or anything), then perhaps the
administrators of these super secure systems should ensure their staff
use screensavers.
Anyhow isn't this something which SELinux was supposed to solve?
Rich.
--
Emerging Technologies, Red Hat - http://et.redhat.com/~rjones/
Registered Address: Red Hat UK Ltd, Amberley Place, 107-111 Peascod
Street, Windsor, Berkshire, SL4 1TE, United Kingdom. Registered in
England and Wales under Company Registration No. 03798903
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3237 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/libvir-list/attachments/20070808/0a29ea4a/attachment-0001.bin>
More information about the libvir-list
mailing list