Ubuntu
libvirt package

  1. Bug #1393842
  2. Comment #42

Comment 42 for bug 1393842

Revision history for this message
Serge Hallyn (serge-hallyn) wrote : Re: [Bug 1393842] Re: libvirt does not grant qemu-guest-agent channel perms

Quoting Jamie Strandboge (<email address hidden>):
> I understand why you are doing this, but this means that a malicious
> guest is now able to create, for example, a block device with only DAC
> protecting the host. Since qemu on Ubuntu runs as non-root, this isn't
> completely horrible, but since apparmor doesn't have fine-grained
> mediation of mknod, it would be better if the guest agent were modified
> to use a socket (perhaps abstract?) so the mknod was not required.

Agreed that would be better. Do you want to open a bug against the QEMU
project and qemu package to that effect?