vmspawn: do not preserve access permissions and xattrs of template OVMF vars

This makes vmspawn work when /usr/share/qemu/edk2-i386-vars.fd is on
disk with 0444 permissions as is the case on NixOS.

The nix package manager does not store any access permissions, ownership,
timestamps, or extended attributes in its package format to increase
reproducibility. The only meta-data that is stored is the executable bit.

Thus when unpacking a nix package, the executable bit is preserved, but no other
access permissions are preserved and all files in /nix/store end up as
read-only.

This causes the template OVMF vars file to have 0444 permissions. If we preserve
those permissions when copying the template file to /tmp that means QEMU can not
write to the file and fails.

So lets not preserve permissions and keep the 0600 permissions that are set by
default.

(cherry picked from commit 96e481bfbd6c52aabc72116f7ff479f11baeead1)
(cherry picked from commit e9c4962cefe786aa6e563bc79657f9f56d0349c5)

diff --git a/src/vmspawn/vmspawn.c b/src/vmspawn/vmspawn.c
index 5b102549e716293f18c001e0ffaecb21342a872d..19c099523ae4991cb6105d6aff8961aca8313123 100644 (file)
--- a/src/vmspawn/vmspawn.c
+++ b/src/vmspawn/vmspawn.c
@@ -1707,9 +1707,7 @@ static int run_virtual_machine(int kvm_device_fd, int vhost_device_fd) {
                 if (r < 0)
                         return log_error_errno(r, "Failed to copy bytes from %s to %s: %m", ovmf_vars_from, ovmf_vars_to);
 
-                /* These aren't always available so don't raise an error if they fail */
-                (void) copy_xattr(source_fd, NULL, target_fd, NULL, 0);
-                (void) copy_access(source_fd, target_fd);
+                /* This isn't always available so don't raise an error if it fails */
                 (void) copy_times(source_fd, target_fd, 0);
 
                 r = strv_extend_many(