Open Stack

On Mon, Jul 23, 2018 at 10:34:11PM +0000, Boeuf, Sebastien wrote:
> Hi Daniel,
> 
> Ok, got it about libvirt being root and being able to change any ownership on files and devices.
> As we run our kata-runtime as root, it can exactly do the same thing as libvirt does, and I'd like
> to understand the details about the way changing ownership works.
> 
> Does libvirt change the ownership of the device back to its initial ownership once it gets
> "released" by Qemu (when Qemu terminates) ?

It will reset ownership back to root when QEMU is quit, except for files
that are designated sharable by multiple VMs.

> Also, the fies created will be owned by the non-root user being chosen, which modifies the
> security associated with those files. When Qemu runs root, only root can access/modify
> them on the host, but by running Qemu as non-root, they will be more accessible since they
> won't be owned by root.

File ownership doesn't influence how accessible files are - file permissions
bits do that. If the file permissions are rwx-------- then only the file
owner can access it, regardless of whether the file owner is root or a non-root
account.

Regards,
Daniel
-- 
|: https://berrange.com      -o-    https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org         -o-            https://fstop138.berrange.com :|
|: https://entangle-photo.org    -o-    https://www.instagram.com/dberrange :|