Open Stack

On Tue, Jul 24, 2018 at 09:19:47AM +0100, Daniel P. Berrangé wrote:
> On Mon, Jul 23, 2018 at 10:34:11PM +0000, Boeuf, Sebastien wrote:
> > Also, the fies created will be owned by the non-root user being chosen, which modifies the
> > security associated with those files. When Qemu runs root, only root can access/modify
> > them on the host, but by running Qemu as non-root, they will be more accessible since they
> > won't be owned by root.
> 
> File ownership doesn't influence how accessible files are - file permissions
> bits do that. If the file permissions are rwx-------- then only the file
> owner can access it, regardless of whether the file owner is root or a non-root
> account.

On top of this libvirt uses SELinux to further restrict access to the
files.  My understanding is each QEMU process runs with its own SELinux
context so that 2 VMs cannot access each other's disk images, even if
the QEMU processes have the same qemu:qemu uid/gid pair.

In other words, the access is even more tightly controlled than just the
UNIX file permissions, it's done on a per-VM basis.

Stefan
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 455 bytes
Desc: not available
URL: <http://lists.katacontainers.io/pipermail/kata-dev/attachments/20180724/8cdcafbc/attachment.sig>