[libvirt] [PATCH] util: Don't delete the original file for truncation

[Daniel P. Berrangé]

On Tue, Aug 21, 2018 at 12:37:54PM +0200, Marc Hartmayer wrote:
> On Tue, Aug 21, 2018 at 11:03 AM +0200, "Daniel P. Berrangé" <berrange at redhat.com> wrote:
> > On Tue, Aug 21, 2018 at 10:49:28AM +0200, Marc Hartmayer wrote:
> >> Truncate means that if a file exists it's length will be truncated to
> >> 0, but the mode and the owner shall be unchanged. The current behavior
> >> is that the original file is deleted and a new file is created. Let's
> >> fix this by using O_TRUNC.
> >
> > This is just describing what you've changed, leaving out why you are
> > trying todo this ?
> 
> Two things:
> 
>  1. The behavior for a console that logs all data to a file has changed
>     with the patch series “qemu: use FD passing for chardev UNIX
>     sockets”. Before this patch series the owner of the log file was the
>     QEMU process user (since the QEMU process was responsible for
>     creating it). Now it’s the virtlogd user.
> 
>     e.g.
> 
>     <console type='file'>
>       <source path='/tmp/console.log'/>
>       <target type='serial'/>
>     </console>

Yes, that ownership change is *good* because the point of the change was
to prevent the QEMU process from ever writing to the logs directly, so
that virtlogd can enforce rollover policies.

>  2. What is currently done by virtlogd is not a truncation (at least
>     IMHO). An alternative to this patch would be to rename the parameter
>     (API change… so probably no option) or document the behavior.

It depends on your POV. If you are looking at the inode it isn't
truncation, because we've just given the inode a new name, and created
a new inode for the original name. If you are looking at the filename
this is truncation, because the file "foo.log" used  to have a size and
now it is zero length.

> >> The function virRotatingFileWriterDelete is now unused but may be used
> >> in the future and is therefore still defined.
> >>
> >> Signed-off-by: Marc Hartmayer <mhartmay at linux.ibm.com>
> >> Reviewed-by: Boris Fiuczynski <fiuczy at linux.ibm.com>
> >> ---
> >> Note:
> >>
> >> This change has the (potentially unwanted) security effect that the
> >> owner/group of the log file does not change. Before this patch the old
> >> log file was deleted and the newly created log file was owned by the
> >> virtlogd user. Now, if a user has created the log file before, he can
> >> read the logs. If we don't wanna have this effect we can either
> >> adjust/add a virtlogd API or do a chown within the calling driver
> >> (e.g. QEMU driver).
> >
> > Pre-creating the log file and/or messing around with ownership are
> > not things we ever intended to support.
> 
> Okay. What should happen if the log file is already pre-created?
> Silently overwrite/delete?

It'll just have the same behaviour is if the file already existed from
a previous boot attempt of the VM. Normal rollover should occurr when
the file size hits the limit. Any changes to ownership are liable to be
thrown away.

Regards,
Daniel
-- 
|: https://berrange.com      -o-    https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org         -o-            https://fstop138.berrange.com :|
|: https://entangle-photo.org    -o-    https://www.instagram.com/dberrange :|