Re: [PATCH] isolation: keep CAP_DAC_OVERRIDE initially

[Cole Robinson <crobinso@redhat.com>]

On 10/7/25 12:02 PM, Stefano Brivio wrote:
> [Cc: Yumei as this is somewhat related to
>  https://archives.passt.top/passt-dev/20250926011714.5978-1-yuhuang@redhat.com/,
>  and David as he wrote most of this part]
> 
> On Tue,  7 Oct 2025 08:16:39 -0400
> Cole Robinson <crobinso@redhat.com> wrote:
> 
>> Reproducer that I'd expect to work
>>
>>   $ cd $HOME
>>   $ sudo passt --runas $UID --socket foo.sock
>>   Failed to bind UNIX domain socket: Permission denied
>>
>> A more practical example is for libguestfs apps when run as user=root.
>>
>> + libguestfs connects to libvirt qemu:///system
>> + libvirt qemu:///system defaults to user=qemu.
>>   + chowns passt runtime dir to user=qemu
>> + libguestfs instead requests the VM run as user=root
>>   + patches in progress but we are blocked by this issue
>> + passt is launched as root, but can't open socket in passt dir.
>>
>> Obviously libvirt needs improvements too.
>> But it seems like this is a defect as well.
> 
> Thanks for the patch! I think it's absolutely unproblematic to keep
> CAP_DAC_OVERRIDE for a moment at the beginning. Did you figure out
> exactly why it's needed by the way?
> 

Last line in the list above should read:

+ passt is launched as root, but can't open socket in passt dir
  because it's owned by qemu.qemu

>> Signed-off-by: Cole Robinson <crobinso@redhat.com>
> 
> Should we add:
> 
> Link: https://github.com/libguestfs/libguestfs/pull/218
> 
> ? Or it's misleading, or you omitted it for any other reason?
> 

Works for me! I did not intentionally omit it

Thanks,
Cole