Open Stack

On Tue, Jul 24, 2018 at 11:40:14AM +0100, Stefan Hajnoczi wrote:
> On Tue, Jul 24, 2018 at 09:19:47AM +0100, Daniel P. Berrangé wrote:
> > On Mon, Jul 23, 2018 at 10:34:11PM +0000, Boeuf, Sebastien wrote:
> > > Also, the fies created will be owned by the non-root user being chosen, which modifies the
> > > security associated with those files. When Qemu runs root, only root can access/modify
> > > them on the host, but by running Qemu as non-root, they will be more accessible since they
> > > won't be owned by root.
> > 
> > File ownership doesn't influence how accessible files are - file permissions
> > bits do that. If the file permissions are rwx-------- then only the file
> > owner can access it, regardless of whether the file owner is root or a non-root
> > account.
> 
> On top of this libvirt uses SELinux to further restrict access to the
> files.  My understanding is each QEMU process runs with its own SELinux
> context so that 2 VMs cannot access each other's disk images, even if
> the QEMU processes have the same qemu:qemu uid/gid pair.
> 
> In other words, the access is even more tightly controlled than just the
> UNIX file permissions, it's done on a per-VM basis.

Yes, out of the box, each VM will get a distinct SELinux context (using
random MCS tag), while sharing the same qemu:qemu user/group. The app
can opt-in to using a separate uid:gid per VM too, if they have a range
of uid:gids reserved for use by VMs.

Regards,
Daniel
-- 
|: https://berrange.com      -o-    https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org         -o-            https://fstop138.berrange.com :|
|: https://entangle-photo.org    -o-    https://www.instagram.com/dberrange :|