[libvirt] [PATCH 2/3] Set basic capabilities needed for libvirtd

[Daniel Veillard]

On Mon, Jun 22, 2009 at 08:58:27PM +0100, Daniel P. Berrange wrote:
> 
> This sets up some basic support in libvirtd for dropping privileges
> by removing capabilities, or changing uid/gid of the process. It 
> needed a little movement of existing code to allow us to drop
> privileges in between initializing the daemon and initializing the
> drivers. 
> 
> As I mentioned in the first mail, this patch doesn't really improve
> security of the daemon, since we keep CAP_DAC_OVERRIDE, CAP_SYS_ADMIN
> and CAP_NET_ADMIN. I've put comments inline showing why I chose to
> keep/exclude each capability.

  the problem is that the amound of capability we can drop is dependant
on the actual set of drivers installed. I have the feeling that each
driver should have a method exporting the capabilities it needs and
once we have initialized the set of drivers then we should drop to the
logical OR'ing of them. I think trying to maintain a global knowledge of
all drivers requirement in a central place won't scale well and that's
better left to the drivers maintainers.

> I also added a helper to util.c for resolving a name to a gid/uid.
> 
> Ignore all the printfs() in the code, those will be removed later
> before I submit this again...

  That said as a first approach that looks fine to me.

Daniel

-- 
Daniel Veillard      | libxml Gnome XML XSLT toolkit  http://xmlsoft.org/
daniel at veillard.com  | Rpmfind RPM search engine http://rpmfind.net/
http://veillard.com/ | virtualization library  http://libvirt.org/