Re: [PATCH] isolation: keep CAP_DAC_OVERRIDE initially

[Cole Robinson <crobinso@redhat.com>]

On 10/7/25 12:49 PM, Stefano Brivio wrote:
> On Tue, 7 Oct 2025 12:43:30 -0400
> Cole Robinson <crobinso@redhat.com> wrote:
> 
>> On 10/7/25 12:02 PM, Stefano Brivio wrote:
>>> [Cc: Yumei as this is somewhat related to
>>>  https://archives.passt.top/passt-dev/20250926011714.5978-1-yuhuang@redhat.com/,
>>>  and David as he wrote most of this part]
>>>
>>> On Tue,  7 Oct 2025 08:16:39 -0400
>>> Cole Robinson <crobinso@redhat.com> wrote:
>>>   
>>>> Reproducer that I'd expect to work
>>>>
>>>>   $ cd $HOME
>>>>   $ sudo passt --runas $UID --socket foo.sock
>>>>   Failed to bind UNIX domain socket: Permission denied
>>>>
>>>> A more practical example is for libguestfs apps when run as user=root.
>>>>
>>>> + libguestfs connects to libvirt qemu:///system
>>>> + libvirt qemu:///system defaults to user=qemu.
>>>>   + chowns passt runtime dir to user=qemu
>>>> + libguestfs instead requests the VM run as user=root
>>>>   + patches in progress but we are blocked by this issue
>>>> + passt is launched as root, but can't open socket in passt dir.
>>>>
>>>> Obviously libvirt needs improvements too.
>>>> But it seems like this is a defect as well.  
>>>
>>> Thanks for the patch! I think it's absolutely unproblematic to keep
>>> CAP_DAC_OVERRIDE for a moment at the beginning. Did you figure out
>>> exactly why it's needed by the way?
>>>   
>>
>> Last line in the list above should read:
>>
>> + passt is launched as root, but can't open socket in passt dir
>>   because it's owned by qemu.qemu
> 
> ...at this point, can you perhaps come up with a complete commit message
> also including the details Rich explained / reported?
> 
> No need to repost. On the other hand it's a single patch so if you
> have a moment you might as well...
> 

v2 sent now

Thanks,
Cole