CSEC_PUBLIC/securityonion
1
0
Fork 0
mirror of https://github.com/Security-Onion-Solutions/securityonion.git synced 2025-12-06 17:22:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

owner and perms of volumes

Browse Source
This commit is contained in:
Josh Patterson
2025-10-09 10:19:25 -04:00
parent f730e23e30
commit e551c6e037
1 changed files with 14 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
salt/hypervisor/tools/sbin_jinja/so-kvm-create-volume
View File

@@ -78,7 +78,7 @@ used during VM provisioning to add dedicated NSM storage volumes.
- Volume files are stored in `/nsm/libvirt/volumes/` with naming pattern `<vm_name>-nsm.img`. - Volume files are stored in `/nsm/libvirt/volumes/` with naming pattern `<vm_name>-nsm.img`.
- Volumes are attached as `/dev/vdb` using virtio-blk for high performance. - Volumes are attached as `/dev/vdb` using virtio-blk for high performance.
- The script checks available disk space before creating the volume. - The script checks available disk space before creating the volume.
- Ownership is set to `socore:socore` with permissions `644`. - Ownership is set to `qemu:qemu` with permissions `640`.
- Without the `-S` flag, the VM remains stopped after volume attachment. - Without the `-S` flag, the VM remains stopped after volume attachment.
**Description:** **Description:**
@@ -98,7 +98,7 @@ The `so-kvm-create-volume` script creates and attaches NSM storage volumes using
3. **Volume Creation:** 3. **Volume Creation:**
- Creates volume directory if it doesn't exist - Creates volume directory if it doesn't exist
- Uses `qemu-img create` with full pre-allocation - Uses `qemu-img create` with full pre-allocation
- Sets proper ownership (socore:socore) and permissions (644) - Sets proper ownership (qemu:qemu) and permissions (640)
- Validates volume creation success - Validates volume creation success
4. **Volume Attachment:** 4. **Volume Attachment:**
@@ -279,20 +279,20 @@ def create_volume_file(vm_name, size_gb, logger):
logger.error(f"VOLUME: qemu-img error: {e.stderr.strip()}") logger.error(f"VOLUME: qemu-img error: {e.stderr.strip()}")
raise VolumeCreationError(f"Failed to create volume: {e}") raise VolumeCreationError(f"Failed to create volume: {e}")
# Set ownership to socore:socore # Set ownership to qemu:qemu
try: try:
socore_uid = pwd.getpwnam('socore').pw_uid qemu_uid = pwd.getpwnam('qemu').pw_uid
socore_gid = grp.getgrnam('socore').gr_gid qemu_gid = grp.getgrnam('qemu').gr_gid
os.chown(volume_path, socore_uid, socore_gid) os.chown(volume_path, qemu_uid, qemu_gid)
logger.info(f"VOLUME: Set ownership to socore:socore") logger.info(f"VOLUME: Set ownership to qemu:qemu")
except (KeyError, OSError) as e: except (KeyError, OSError) as e:
logger.error(f"VOLUME: Failed to set ownership: {e}") logger.error(f"VOLUME: Failed to set ownership: {e}")
raise VolumeCreationError(f"Failed to set ownership: {e}") raise VolumeCreationError(f"Failed to set ownership: {e}")
# Set permissions to 644 # Set permissions to 640
try: try:
os.chmod(volume_path, 0o644) os.chmod(volume_path, 0o640)
logger.info(f"VOLUME: Set permissions to 644") logger.info(f"VOLUME: Set permissions to 640")
except OSError as e: except OSError as e:
logger.error(f"VOLUME: Failed to set permissions: {e}") logger.error(f"VOLUME: Failed to set permissions: {e}")
raise VolumeCreationError(f"Failed to set permissions: {e}") raise VolumeCreationError(f"Failed to set permissions: {e}")
@@ -492,10 +492,10 @@ def main():
# Ensure volume directory exists before checking disk space # Ensure volume directory exists before checking disk space
try: try:
os.makedirs(VOLUME_DIR, mode=0o755, exist_ok=True) os.makedirs(VOLUME_DIR, mode=0o754, exist_ok=True)
socore_uid = pwd.getpwnam('socore').pw_uid qemu_uid = pwd.getpwnam('qemu').pw_uid
socore_gid = grp.getgrnam('socore').gr_gid qemu_gid = grp.getgrnam('qemu').gr_gid
os.chown(VOLUME_DIR, socore_uid, socore_gid) os.chown(VOLUME_DIR, qemu_uid, qemu_gid)
logger.debug(f"VOLUME: Ensured volume directory exists: {VOLUME_DIR}") logger.debug(f"VOLUME: Ensured volume directory exists: {VOLUME_DIR}")
except Exception as e: except Exception as e:
logger.error(f"VOLUME: Failed to create volume directory: {e}") logger.error(f"VOLUME: Failed to create volume directory: {e}")