[Pkg-libvirt-maintainers] Bug#701649: libvirt-bin - libvirtd changes permissions of devices to libvirt-qemu:kvm

[Bastian Blank]

Package: libvirt-bin
Version: 1.0.2-2
Severity: critical
Tags: security

libvirtd changes the permissions of lvm devices it assigns to guests to
libvirt-qemu:kvm. kvm is a general group and not restricted to libvirt.
The allows other users write access to this devices.

I'm right now unsure if the Wheezy version is affected.

| brw-rw---T 1 libvirt-qemu kvm  254, 11 Feb 25 17:08 /dev/dm-11
| brw-rw---T 1 libvirt-qemu kvm  254, 12 Feb 25 17:50 /dev/dm-12

Bastian

-- System Information:
Debian Release: 7.0
  APT prefers testing
  APT policy: (990, 'testing'), (500, 'unstable'), (1, 'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 3.7-trunk-amd64 (SMP w/4 CPU cores)
Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash