From: Jiri Denemark <jdenemar@redhat.com>
Date: Fri, 22 Nov 2013 11:13:03 +0000 (+0100)
Subject: spec: Restrict virt-login-shell usage
X-Git-Tag: v1.2.0-rc1~25
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=0ee2364319c4b11d7e5eca5856d458b24a900024;p=thirdparty%2Flibvirt.git

spec: Restrict virt-login-shell usage

https://bugzilla.redhat.com/show_bug.cgi?id=1033614

As virt-login-shell is an SUID binary, we should restrict its usage to
just the users chosen by an administrator to use virt-login-shell as
their login shell. This can easily be done by making the binary
executable only by users from a new virtlogin group.
---

diff --git a/libvirt.spec.in b/libvirt.spec.in
index a5b01dffbc..864fbf44f3 100644
--- a/libvirt.spec.in
+++ b/libvirt.spec.in
@@ -1727,6 +1727,12 @@ if getent group sanlock > /dev/null ; then
 fi
 %endif
 
+%if %{with_lxc}
+%pre login-shell
+getent group virtlogin >/dev/null || groupadd -r virtlogin
+exit 0
+%endif
+
 %files
 %defattr(-, root, root)
 
@@ -2072,7 +2078,7 @@ fi
 
 %if %{with_lxc}
 %files login-shell
-%attr(4755, root, root) %{_bindir}/virt-login-shell
+%attr(4750, root, virtlogin) %{_bindir}/virt-login-shell
 %config(noreplace) %{_sysconfdir}/libvirt/virt-login-shell.conf
 %{_mandir}/man1/virt-login-shell.1*
 %endif