On Tue, Jul 24, 2018 at 09:19:47AM +0100, Daniel P. Berrangé wrote:
On Mon, Jul 23, 2018 at 10:34:11PM +0000, Boeuf, Sebastien wrote:
Also, the fies created will be owned by the non-root user being chosen, which modifies the security associated with those files. When Qemu runs root, only root can access/modify them on the host, but by running Qemu as non-root, they will be more accessible since they won't be owned by root.
File ownership doesn't influence how accessible files are - file permissions bits do that. If the file permissions are rwx-------- then only the file owner can access it, regardless of whether the file owner is root or a non-root account.
On top of this libvirt uses SELinux to further restrict access to the files. My understanding is each QEMU process runs with its own SELinux context so that 2 VMs cannot access each other's disk images, even if the QEMU processes have the same qemu:qemu uid/gid pair. In other words, the access is even more tightly controlled than just the UNIX file permissions, it's done on a per-VM basis. Stefan