Thanks for your answers Daniel and Stefan, This helps :) Sebastien ________________________________________ From: Daniel P. Berrangé [berrange@redhat.com] Sent: Tuesday, July 24, 2018 3:42 AM To: Stefan Hajnoczi Cc: Boeuf, Sebastien; kata-dev@lists.katacontainers.io Subject: Re: [kata-dev] Improving isolation in Kata On Tue, Jul 24, 2018 at 11:40:14AM +0100, Stefan Hajnoczi wrote:
On Tue, Jul 24, 2018 at 09:19:47AM +0100, Daniel P. Berrangé wrote:
On Mon, Jul 23, 2018 at 10:34:11PM +0000, Boeuf, Sebastien wrote:
Also, the fies created will be owned by the non-root user being chosen, which modifies the security associated with those files. When Qemu runs root, only root can access/modify them on the host, but by running Qemu as non-root, they will be more accessible since they won't be owned by root.
File ownership doesn't influence how accessible files are - file permissions bits do that. If the file permissions are rwx-------- then only the file owner can access it, regardless of whether the file owner is root or a non-root account.
On top of this libvirt uses SELinux to further restrict access to the files. My understanding is each QEMU process runs with its own SELinux context so that 2 VMs cannot access each other's disk images, even if the QEMU processes have the same qemu:qemu uid/gid pair.
In other words, the access is even more tightly controlled than just the UNIX file permissions, it's done on a per-VM basis.
Yes, out of the box, each VM will get a distinct SELinux context (using random MCS tag), while sharing the same qemu:qemu user/group. The app can opt-in to using a separate uid:gid per VM too, if they have a range of uid:gids reserved for use by VMs. Regards, Daniel -- |: https://berrange.com -o- https://www.flickr.com/photos/dberrange :| |: https://libvirt.org -o- https://fstop138.berrange.com :| |: https://entangle-photo.org -o- https://www.instagram.com/dberrange :|