From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.43) id 1NLHHV-0001xn-3k for qemu-devel@nongnu.org; Thu, 17 Dec 2009 09:24:41 -0500 Received: from exim by lists.gnu.org with spam-scanned (Exim 4.43) id 1NLHHQ-0001vc-DZ for qemu-devel@nongnu.org; Thu, 17 Dec 2009 09:24:40 -0500 Received: from [199.232.76.173] (port=36445 helo=monty-python.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1NLHHQ-0001vO-0h for qemu-devel@nongnu.org; Thu, 17 Dec 2009 09:24:36 -0500 Received: from mx1.redhat.com ([209.132.183.28]:38312) by monty-python.gnu.org with esmtp (Exim 4.60) (envelope-from ) id 1NLHHP-0002zl-EO for qemu-devel@nongnu.org; Thu, 17 Dec 2009 09:24:35 -0500 Message-ID: <4B2A3ED6.40908@redhat.com> Date: Thu, 17 Dec 2009 15:23:18 +0100 From: Kevin Wolf MIME-Version: 1.0 Subject: Re: [Qemu-devel] [PATCH] A different way to ask for readonly drive References: <4B263F0B.90408@redhat.com> <4B265F7D.1010109@mail.berlios.de> <20091215184501.GB21298@shareable.org> <20091217105004.GA17205@lst.de> <20091217131635.GA24967@shareable.org> In-Reply-To: <20091217131635.GA24967@shareable.org> Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit List-Id: qemu-devel.nongnu.org List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Jamie Lokier Cc: Naphtali Sprei , Christoph Hellwig , qemu-devel@nongnu.org Am 17.12.2009 14:16, schrieb Jamie Lokier: > Christoph Hellwig wrote: >> On Tue, Dec 15, 2009 at 06:45:01PM +0000, Jamie Lokier wrote: >>> access=rw >>> access=ro >>> access=auto (default) >> >> Yes, that sounds like the least clumsy one. I still think the current >> implementation is a very bad default, though. > > Without agreeing or disagreeing over whether it's a bad default :), a > usability problem occurs with the current implementation when you > deliberately "chmod 444" an image to have high confidence that it's > opened read only: When running as root, file permissions are ignored > (except sometimes on NFS). > > For that reason I use "chattr +i" on all my read-only image files, to > really make sure that no qemu invocation mistake could accidentally > corrupt valuable images. That works, but it's not very convenient. > > If the "auto" method is kept, I think it would be an improvement if it > checks the file permission itself, and does not even try to open a > file O_RDWR if there are no writable permission bits - so that "chmod > 444" has the same "open as read only" effect when qemu is invoked as root. I don't think that this makes sense. That you can write the file as root is a feature of your OS and qemu has nothing to do with it. Doing anything else than accessing it would actually be unexpected behaviour on this OS. We're just writing an application, not a better OS. You can decide to protect your images with the qemu readonly option and get the protection that qemu defines, or you take the permissions of the OS and get from the OS whatever the definition of that protection is (including write access for root). qemu can't and shouldn't know that you use the OS's protection but actually don't quite mean what it's defined to be. Kevin