[libvirt] Problem configuring selective dropping of root

[Pavel Hrdina]

On Wed, Jul 10, 2019 at 12:01:18AM +0200, Stephan von Krawczynski wrote:
> On Tue, 9 Jul 2019 14:26:08 +0200
> Pavel Hrdina <phrdina at redhat.com> wrote:
> 
> > [...]
> > 
> > In addition if you would like to have only one VM as root:root you
> > should keep the default config as nobody:kvm and use the root:root for
> > that specific VM.
> > 
> > Pavel
> 
> Let me answer this part in another post.
> Generally I agree with you. But there is one question: if I configure libvirt
> to use nobody:kvm as user, how is it possible to start a qemu with root
> privileges? I thought it not to be possible that it runs a root process while
> its config says it should be nobody ...?

That configuration is in /etc/libvirt/qemu.conf which configures things
related to QEMU process and the user:group configuration tells how the
QEMU process will be started.  The system libvirtd daemon runs always as
root:root in order to have permissions to execute QEMU process under any
user and to configure a lot of other things when starting a VM.

> I thought it can only _drop_ privileges from root to nobody, because its
> primary user is root.
> Or is it in fact always running as root, and only "fake-dropping" to the
> configured user (maybe a spawned child), while still being able to spawn other
> root processes?

I'm not sure what do you mean by "fake-dropping", libvirt forks itself
in order to create a new process where the QEMU binary is executed and
the permissions are configured for that newly created process.

All of this is true only for the system libvirt, that means if you use
qemu:///system connection, for the session libvirt everything runs as
your user and there is no session libvirt for root user.

The XML and configuration that I've suggested should work as I've tried
it before sending the mail.

Pavel
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/libvir-list/attachments/20190710/5d900d44/attachment-0001.sig>