From 3e02ee9b5da7fc7197aaa6d57563349a7670b8a1 Mon Sep 17 00:00:00 2001

From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>

Date: Wed, 13 Mar 2019 16:21:15 +0000

Subject: [PATCH 5/5] network: avoid trying to create global firewall rules if

 unprivileged

MIME-Version: 1.0

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit

The unprivileged libvirtd does not have permission to create firewall

rules, or bridge devices, or do anything to the host network in

general. Historically we still activate the network driver though and

let the network start API call fail.

The startup code path which reloads firewall rules on active networks

would thus effectively be a no-op when unprivileged as it is impossible

for there to be any active networks

With the change to use a global set of firewall chains, however, we now

have code that is run unconditionally.

Ideally we would not register the network driver at all when

unprivileged, but the entanglement with the virt drivers currently makes

that impractical. As a temporary hack, we just make the firewall reload

into a no-op.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>

(cherry picked from commit 5d010c3df6152cf5fb00f1f67d22151241f4a8a2)

---

 src/network/bridge_driver.c | 4 ++++

 1 file changed, 4 insertions(+)

diff --git a/src/network/bridge_driver.c b/src/network/bridge_driver.c

index 1da60f0a21..0e1d5efd8e 100644

--- a/src/network/bridge_driver.c

+++ b/src/network/bridge_driver.c

@@ -2108,6 +2108,10 @@ static void

 networkReloadFirewallRules(virNetworkDriverStatePtr driver, bool startup)

 {

     VIR_INFO("Reloading iptables rules");

+    /* Ideally we'd not even register the driver when unprivilegd

+     * but until we untangle the virt driver that's not viable */

+    if (!driver->privileged)

+        return;

     networkPreReloadFirewallRules(startup);

     virNetworkObjListForEach(driver->networks,

                              networkReloadFirewallRulesHelper,

-- 

2.20.1