Questions about the ownership of /var/cache/libvirt/qemu

[Peng Liang]

On 8/23/2021 3:57 PM, Michal Prívozník wrote:
> On 8/22/21 11:49 AM, Peng Liang wrote:
>> Hi all,
>>   When we change the user for QEMU process (change "user" and "group" in
>> /etc/libvirt/qemu.conf) to a normal user, we found that libvirtd will
>> also change the ownership of /var/cache/libvirt/qemu but will keep the
>> ownership of /var/cache/libvirt/qemu/capabilities as root.
>>   Is it secure to put files/directories owned by root in a directory
>> owned by a normal user?  Could the normal user replace the root's file
>> with a new one?  
> 
> No, the capabilities directory lacks write perms:
> 
> drwxr-xr-x 2 root root 234 Aug 20 17:11
> /var/cache/libvirt/qemu/capabilities/
> 
> and caps files themselves are RW by root only:
> 
> -rw------- 1 root root 144215 Aug 20 15:38
> 926803a9278e445ec919c2b6cbd8c1c449c75b26dcb1686b774314180376c725.xml
> 
> Therefore, I don't think a regular user could spoof capabilities.

But the regular user can rename capabilities and create a new one.  For
example,
# runuser -u qemu -- mv /var/cache/libvirt/qemu/capabilities
/var/cache/libvirt/qemu/capabilities-bak
# runuser -u qemu -- mkdir /var/cache/libvirt/qemu/capabilities
runuser -u qemu -- touch /var/cache/libvirt/qemu/capabilities/<hash>.xml
And I found that the operations can be done even though the sticky bit
is set on /var/cache/libvirt/qemu :(

> 
>> Does it need to set sticky bit on
>> /var/cache/libvirt/qemu or keep the ownership of /var/cache/libvirt/qemu
>> as root?
>>
> 
> No, setting sticky bit would make caps files owned by root:group and I
> don't think we want that (even though, not even group can write caps files).
> 
> I hope this answers your concern.

I found that libvirt will put some temporary files (e.g. screenshot
files) which are used by qemu in /var/cache/libvirt/qemu.  How about
move those files to domain dirs in /var/run/libvirt/qemu and keep the
ownership of /var/cache/libvirt/qemu as root?

Thanks,
Peng

> 
> Michal
> 
> .
>