Arch Linux

Please read this before reporting a bug:
https://wiki.archlinux.org/title/Bug_reporting_guidelines

Do NOT report bugs when a package is just outdated, or it is in the AUR. Use the 'flag out of date' link on the package page, or the Mailing List.

REPEAT: Do NOT report bugs for outdated packages!
Tasklist

FS#45990 - [ovmf] change permission to 0666 to allow non-root qemu access

Attached to Project: Arch Linux
Opened by Tom Yan (tom.ty89) - Saturday, 15 August 2015, 09:09 GMT
Last edited by Doug Newgard (Scimmia) - Sunday, 01 November 2015, 16:29 GMT
Task Type Feature Request
Category Packages: Extra
Status Closed
Assigned To Thomas Bächler (brain0)
Architecture All
Severity Low
Priority Normal
Reported Version
Due in Version Undecided
Due Date Undecided
Percent Complete 100%
Votes 1
Private No

Details

Description:
qemu checks whether the user has write permission on the firmware files. Having the files with permission of 0666 allows qemu to have access to the files even when running with non-root users.

Steps to reproduce:
[tom@localhost ~]$ ls -l /usr/share/ovmf/ovmf_x64.bin
-rw-r--r-- 1 root root 1048576 Aug 15 16:59 /usr/share/ovmf/ovmf_x64.bin
[tom@localhost ~]$ qemu-system-x86_64 -enable-kvm -drive file=/usr/share/ovmf/ovmf_x64.bin,format=raw,if=pflash
qemu-system-x86_64: -drive file=/usr/share/ovmf/ovmf_x64.bin,format=raw,if=pflash: Could not open '/usr/share/ovmf/ovmf_x64.bin': Permission denied
[tom@localhost ~]$ sudo chmod 666 /usr/share/ovmf/ovmf_x64.bin
[tom@localhost ~]$ qemu-system-x86_64 -enable-kvm -drive file=/usr/share/ovmf/ovmf_x64.bin,format=raw,if=pflash
^Cqemu: terminating on signal 2
[tom@localhost ~]$
This task depends upon

Closed by  Doug Newgard (Scimmia)
Sunday, 01 November 2015, 16:29 GMT
Reason for closing:  Not a bug
Additional comments about closing:  Requested by user
Comment by Gerardo Exequiel Pozzi (djgera) - Saturday, 15 August 2015, 22:22 GMT
So any user can modify a system file...

Please read the documentation. Use something like: -drive if=pflash,format=raw,readonly,file=/usr/share/ovmf/ovmf_x64.bin -drive if=pflash,format=raw,file=efi-vars.img
Comment by Richard Tollerton (rtollert) - Tuesday, 01 September 2015, 20:02 GMT
I believe the correct way of solving this is to package the split images (OVMF_CODE.fd and OVMF_VARS.fd); patch sent to Thomas.
Comment by Tom Yan (tom.ty89) - Tuesday, 08 September 2015, 20:47 GMT
Yeah never mind I wasn't aware of the readonly option, partly because the old "-pflash" shortcut does not access it in readonly mode either, though that's a qemu thing anyway.

No idea what this CODE/VARS split is about.
Comment by Gerardo Exequiel Pozzi (djgera) - Tuesday, 08 September 2015, 22:14 GMT
Yep, anyway the example that I wrote is for split files(*), otherwise, there is no way to save modifications.

(*) split in the two parts with dd at [0-128K) {vars}, [128K-end] {code} versions must match.

Comment by Tom Yan (tom.ty89) - Thursday, 10 September 2015, 17:05 GMT
Oh NVRAM! Never need to deal with that in a VM before so I didn't realize you guys were talking about it. I filed this only because I missed the readonly option, heh.

Loading...