RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 1017689 - /usr/libexec/qemu-bridge-helper permissions should be 4755
Summary: /usr/libexec/qemu-bridge-helper permissions should be 4755
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: qemu-kvm
Version: 7.0
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: rc
: ---
Assignee: Miroslav Rezanina
QA Contact: Virtualization Bugs
URL:
Whiteboard:
Depends On:
Blocks: 884569
TreeView+ depends on / blocked
 
Reported: 2013-10-10 10:46 UTC by Paolo Bonzini
Modified: 2014-06-18 03:39 UTC (History)
5 users (show)

Fixed In Version: qemu-kvm-1.5.3-17.el7
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2014-06-13 09:58:02 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)

Description Paolo Bonzini 2013-10-10 10:46:50 UTC 
/usr/libexec/qemu-bridge-helper needs capabilities to set up a bridge.

Libvirt was changed in version 1.0.5 to not use the helper when running in system mode (commit 2d80fbb, qemu: launch bridge helper from libvirtd, 2013-04-20).  System mode is the only mode that matters for common criteria certifications.
Comment 2 Miroslav Rezanina 2013-11-07 15:55:47 UTC 
Fix included in qemu-kvm-1.5.3-17.el7
Comment 4 Qian Guo 2013-12-17 07:23:41 UTC 
Hi, Paolo

I checked with qemu-kvm-1.5.3-21.el7.x86_64 , that the qemu-bridge-helper's permission is 4755:
# stat /usr/libexec/qemu-bridge-helper 
  File: ‘/usr/libexec/qemu-bridge-helper’
  Size: 15336     	Blocks: 32         IO Block: 4096   regular file
Device: fd00h/64768d	Inode: 1403635     Links: 1
Access: (4755/-rwsr-xr-x)  Uid: (    0/    root)   Gid: (    0/    root)
Context: system_u:object_r:virt_bridgehelper_exec_t:s0
Access: 2013-12-17 03:43:49.840111230 +0800
Modify: 2013-12-03 13:40:16.000000000 +0800
Change: 2013-12-13 15:25:37.942931532 +0800
 Birth: -


But I found the permission of build before qemu-kvm-1.5.3-17.el7 (I used qemu-kvm-1.5.1-2.el7.x86_64) is 4755 too, so I am not sure if this bug is verified by this way.

(In reply to Paolo Bonzini from comment #0)
> /usr/libexec/qemu-bridge-helper needs capabilities to set up a bridge.
>
Test with both qemu-kvm build, since the permission is 4755 for both, I can boot guest using the tap that set up by the bridge-helper via unprivilege user:

Steps:
1.Check the existing bridge:
$ brctl show
bridge name	bridge id		STP enabled	interfaces
switch		0080.24be0518809b	no		em1

2.Confirm the qemu-bridge-helper acl that permit the switch :
$ cat /etc/qemu-kvm/bridge.conf 
allow virbr0
allow switch

3.Launch qemu with network by this helper
$ /usr/libexec/qemu-kvm -net bridge,br=switch -monitor stdio

qemu) info network
hub 0
 \ bridge.0: index=0,type=tap,helper=/usr/libexec/qemu-bridge-helper,br=switch

4.Check the interfaces 
$ brctl show
bridge name	bridge id		STP enabled	interfaces
switch		0080.24be0518809b	no		em1
							tap0

Paolo, can we verify this bug according to above ?

thanks,
qiguo
Comment 5 Paolo Bonzini 2013-12-17 16:38:44 UTC 
Yes, thanks!
Comment 6 Qian Guo 2013-12-20 02:26:30 UTC 
According to comment #4 and comment #5 , this bug can be verified by qemu-kvm-1.5.3-21.el7.x86_64 .
Comment 8 Ludek Smid 2014-06-13 09:58:02 UTC 
This request was resolved in Red Hat Enterprise Linux 7.0.

Contact your manager or support representative in case you have further questions about the request.
Note You need to log in before you can comment on or make changes to this bug.