[Pkg-libvirt-maintainers] Bug#701649: Bug#701649: libvirt-bin - libvirtd changes permissions of devices to libvirt-qemu:kvm

[Guido Günther]

On Mon, Feb 25, 2013 at 06:57:50PM +0100, Bastian Blank wrote:
> Package: libvirt-bin
> Version: 1.0.2-2
> Severity: critical
> Tags: security
> 
> libvirtd changes the permissions of lvm devices it assigns to guests to
> libvirt-qemu:kvm. kvm is a general group and not restricted to libvirt.
> The allows other users write access to this devices.

This is configuratble via the group option in /etc/libvirt/qemu.conf. I
do think that kvm is a reasonable choice since kvm isn't a general
purpose group but one reserved for processes running kvm instances.

However I'm open for discussion to switch this to libvirt-qemu as well.
(but leaving kvm as the libvirt-qemu user's primary group).
Cheers,
 -- Guido

> 
> I'm right now unsure if the Wheezy version is affected.
> 
> | brw-rw---T 1 libvirt-qemu kvm  254, 11 Feb 25 17:08 /dev/dm-11
> | brw-rw---T 1 libvirt-qemu kvm  254, 12 Feb 25 17:50 /dev/dm-12
> 
> Bastian
> 
> -- System Information:
> Debian Release: 7.0
>   APT prefers testing
>   APT policy: (990, 'testing'), (500, 'unstable'), (1, 'experimental')
> Architecture: amd64 (x86_64)
> Foreign Architectures: i386
> 
> Kernel: Linux 3.7-trunk-amd64 (SMP w/4 CPU cores)
> Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8)
> Shell: /bin/sh linked to /bin/dash
> 
> _______________________________________________
> Pkg-libvirt-maintainers mailing list
> Pkg-libvirt-maintainers at lists.alioth.debian.org
> http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pkg-libvirt-maintainers
>