Make sure qemu.conf isn't world readable by default

since the user might add passwords to it.

Closes: #710537

debian/libvirt-bin.postinst

@@ -61,6 +61,8 @@ add_statoverrides()
 
     SANLOCK_DIR="/var/lib/libvirt/sanlock"
 
+    QEMU_CONF="/etc/libvirt/qemu.conf"
+
     for dir in ${ROOT_DIRS}; do
         if ! dpkg-statoverride --list "${dir}" >/dev/null 2>&1; then
             chown root:root "${dir}"
@@ -79,6 +81,11 @@ add_statoverrides()
         chown root:root "${SANLOCK_DIR}"
         chmod 0700 "${SANLOCK_DIR}"
     fi
+
+    if ! dpkg-statoverride --list "${QEMU_CONF}" >/dev/null 2>&1; then
+        chown root:root "${QEMU_CONF}"
+        chmod 0600 "${QEMU_CONF}"
+    fi
 }