On Mon, Feb 25, 2013 at 06:57:50PM +0100, Bastian Blank wrote: > Package: libvirt-bin > Version: 1.0.2-2 > Severity: critical > Tags: security > > libvirtd changes the permissions of lvm devices it assigns to guests to > libvirt-qemu:kvm. kvm is a general group and not restricted to libvirt. > The allows other users write access to this devices.
This is configuratble via the group option in /etc/libvirt/qemu.conf. I do think that kvm is a reasonable choice since kvm isn't a general purpose group but one reserved for processes running kvm instances. However I'm open for discussion to switch this to libvirt-qemu as well. (but leaving kvm as the libvirt-qemu user's primary group). Cheers, -- Guido > > I'm right now unsure if the Wheezy version is affected. > > | brw-rw---T 1 libvirt-qemu kvm 254, 11 Feb 25 17:08 /dev/dm-11 > | brw-rw---T 1 libvirt-qemu kvm 254, 12 Feb 25 17:50 /dev/dm-12 > > Bastian > > -- System Information: > Debian Release: 7.0 > APT prefers testing > APT policy: (990, 'testing'), (500, 'unstable'), (1, 'experimental') > Architecture: amd64 (x86_64) > Foreign Architectures: i386 > > Kernel: Linux 3.7-trunk-amd64 (SMP w/4 CPU cores) > Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8) > Shell: /bin/sh linked to /bin/dash > > _______________________________________________ > Pkg-libvirt-maintainers mailing list > pkg-libvirt-maintain...@lists.alioth.debian.org > http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pkg-libvirt-maintainers > -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
