The 'Create' API of the two storage file backends is used only on
code-paths where we need to format the image after creating an empty
file. Since the DAC security driver only modifies the owner of the file
and not the mode we need to create all files which are going to be
formatted with the write bit set for the user.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
---
 src/storage/storage_file_fs.c      | 6 +-----
 src/storage/storage_file_gluster.c | 6 +-----
 2 files changed, 2 insertions(+), 10 deletions(-)

diff --git a/src/storage/storage_file_fs.c b/src/storage/storage_file_fs.c
index 0d3f134765..8aafd58992 100644
--- a/src/storage/storage_file_fs.c
+++ b/src/storage/storage_file_fs.c
@@ -84,13 +84,9 @@ virStorageFileBackendFileInit(virStorageSourcePtr src)
 static int
 virStorageFileBackendFileCreate(virStorageSourcePtr src)
 {
-    mode_t mode = S_IRUSR;
     VIR_AUTOCLOSE fd = -1;

-    if (!src->readonly)
-        mode |= S_IWUSR;
-
-    if ((fd = virFileOpenAs(src->path, O_WRONLY | O_TRUNC | O_CREAT, mode,
+    if ((fd = virFileOpenAs(src->path, O_WRONLY | O_TRUNC | O_CREAT, S_IRUSR | S_IWUSR,
                             src->drv->uid, src->drv->gid, 0)) < 0) {
         errno = -fd;
         return -1;
diff --git a/src/storage/storage_file_gluster.c b/src/storage/storage_file_gluster.c
index f389a94437..608f93d2f6 100644
--- a/src/storage/storage_file_gluster.c
+++ b/src/storage/storage_file_gluster.c
@@ -152,13 +152,9 @@ virStorageFileBackendGlusterCreate(virStorageSourcePtr src)
 {
     virStorageFileBackendGlusterPrivPtr priv = src->drv->priv;
     glfs_fd_t *fd = NULL;
-    mode_t mode = S_IRUSR;
-
-    if (!src->readonly)
-        mode |= S_IWUSR;

     if (!(fd = glfs_creat(priv->vol, src->path,
-                          O_CREAT | O_TRUNC | O_WRONLY, mode)))
+                          O_CREAT | O_TRUNC | O_WRONLY, S_IRUSR | S_IWUSR)))
         return -1;

     ignore_value(glfs_close(fd));
-- 
2.26.2

On a Monday in 2020, Peter Krempa wrote:
>The 'Create' API of the two storage file backends is used only on
>code-paths where we need to format the image after creating an empty
>file. Since the DAC security driver only modifies the owner of the file
>and not the mode we need to create all files which are going to be
>formatted with the write bit set for the user.
>
>Signed-off-by: Peter Krempa <pkrempa@redhat.com>
>---
> src/storage/storage_file_fs.c      | 6 +-----
> src/storage/storage_file_gluster.c | 6 +-----
> 2 files changed, 2 insertions(+), 10 deletions(-)
>

Reviewed-by: Ján Tomko <jtomko@redhat.com>

Jano