* [Qemu-devel] question：about pr-helper unlink sock file fail
@ 2019-06-17 4:10 wangjie (P)
2019-06-18 17:34 ` Paolo Bonzini
0 siblings, 1 reply; 2+ messages in thread
From: wangjie (P) @ 2019-06-17 4:10 UTC (permalink / raw)
To: Paolo Bonzini, Michal Privoznik
Cc: zhangjixiang2, qemu-block, Fangyi (C), oscar.zhangbo, qemu-devel,
wangjie88
Hi, I found there is a bug in pr-helper:
We run pr-helper process in root, and drop all capabilities expect
CAP_SYS_RAWIO.
But the sock file which connect from qemu is owned by qemu group,
when pr-helper exit,
it will call “close_server_socket ->
object_unref(OBJECT(server_ioc)) -> qio_channel_socket_finalize ->
socket_listen_cleanup” ,
unlink sock file will fail and output “Failed to unlink socket
xxx, Permission denied”.
I tried to add capability CAP_DAC_OVERRIDE in pr-helper, it will
unlink sock success, but I think capability CAP_DAC_OVERRIDE is too
dangerous.
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: [Qemu-devel] question：about pr-helper unlink sock file fail
2019-06-17 4:10 [Qemu-devel] question：about pr-helper unlink sock file fail wangjie (P)
@ 2019-06-18 17:34 ` Paolo Bonzini
0 siblings, 0 replies; 2+ messages in thread
From: Paolo Bonzini @ 2019-06-18 17:34 UTC (permalink / raw)
To: wangjie (P), Michal Privoznik
Cc: zhangjixiang2, oscar.zhangbo, qemu-devel, qemu-block, Fangyi (C)
On 17/06/19 06:10, wangjie (P) wrote:
> Hi, I found there is a bug in pr-helper:
>
> We run pr-helper process in root, and drop all capabilities expect
> CAP_SYS_RAWIO.
>
> But the sock file which connect from qemu is owned by qemu group,
> when pr-helper exit,
>
> it will call “close_server_socket ->
> object_unref(OBJECT(server_ioc)) -> qio_channel_socket_finalize ->
> socket_listen_cleanup” ,
>
> unlink sock file will fail and output “Failed to unlink socket xxx,
> Permission denied”.
>
> I tried to add capability CAP_DAC_OVERRIDE in pr-helper, it will
> unlink sock success, but I think capability CAP_DAC_OVERRIDE is too
> dangerous.
Interesting... yeah, CAP_DAC_OVERRIDE is a big big hammer. I think this
would be fixed by also changing owner and group of the pr-helper to
qemu; it should work because it uses CAP_SYS_RAWIO.
Paolo
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2019-06-18 17:43 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2019-06-17 4:10 [Qemu-devel] question：about pr-helper unlink sock file fail wangjie (P)
2019-06-18 17:34 ` Paolo Bonzini
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).