[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH 7/8] os-posix: Provide new -runasid option
From: |
Ian Jackson |
Subject: |
[Qemu-devel] [PATCH 7/8] os-posix: Provide new -runasid option |
Date: |
Wed, 4 Oct 2017 16:53:11 +0100 |
This allows the caller to specify a uid and gid to use, even if there
is no corresponding password entry. This will be useful in certain
Xen configurations.
Signed-off-by: Ian Jackson <address@hidden>
---
v2: Coding style fixes.
---
os-posix.c | 31 +++++++++++++++++++++++++++----
qemu-options.hx | 12 ++++++++++++
2 files changed, 39 insertions(+), 4 deletions(-)
diff --git a/os-posix.c b/os-posix.c
index 92e9d85..d63680b 100644
--- a/os-posix.c
+++ b/os-posix.c
@@ -43,6 +43,8 @@
#endif
static struct passwd *user_pwd;
+static uid_t user_uid = (uid_t)-1;
+static gid_t user_gid = (gid_t)-1;
static const char *chroot_dir;
static int daemonize;
static int daemon_pipe;
@@ -134,6 +136,9 @@ void os_set_proc_name(const char *s)
*/
void os_parse_cmd_args(int index, const char *optarg)
{
+ unsigned long lv;
+ char *ep;
+ int rc;
switch (index) {
#ifdef CONFIG_SLIRP
case QEMU_OPTION_smb:
@@ -150,6 +155,22 @@ void os_parse_cmd_args(int index, const char *optarg)
exit(1);
}
break;
+ case QEMU_OPTION_runasid:
+ errno = 0;
+ lv = strtoul(optarg, &ep, 0); /* can't qemu_strtoul, want *ep=='.' */
+ user_uid = lv; /* overflow here is ID in C99 */
+ if (errno || *ep != '.' || user_uid != lv || user_uid == (uid_t)-1) {
+ fprintf(stderr, "Could not obtain uid from \"%s\"", optarg);
+ exit(1);
+ }
+ lv = 0;
+ rc = qemu_strtoul(ep + 1, 0, 0, &lv);
+ user_gid = lv; /* overflow here is ID in C99 */
+ if (rc || user_gid != lv || user_gid == (gid_t)-1) {
+ fprintf(stderr, "Could not obtain gid from \"%s\"", optarg);
+ exit(1);
+ }
+ break;
case QEMU_OPTION_chroot:
chroot_dir = optarg;
break;
@@ -166,17 +187,19 @@ void os_parse_cmd_args(int index, const char *optarg)
static void change_process_uid(void)
{
- if (user_pwd) {
- if (setgid(user_pwd->pw_gid) < 0) {
+ if (user_pwd || user_uid != (uid_t)-1) {
+ if (setgid(user_pwd ? user_pwd->pw_gid : user_gid) < 0) {
fprintf(stderr, "Failed to setgid(%d)\n", user_pwd->pw_gid);
exit(1);
}
- if (initgroups(user_pwd->pw_name, user_pwd->pw_gid) < 0) {
+ if ((user_pwd
+ ? initgroups(user_pwd->pw_name, user_pwd->pw_gid)
+ : setgroups(1, &user_gid)) < 0) {
fprintf(stderr, "Failed to initgroups(\"%s\", %d)\n",
user_pwd->pw_name, user_pwd->pw_gid);
exit(1);
}
- if (setuid(user_pwd->pw_uid) < 0) {
+ if (setuid(user_pwd ? user_pwd->pw_uid : user_gid) < 0) {
fprintf(stderr, "Failed to setuid(%d)\n", user_pwd->pw_uid);
exit(1);
}
diff --git a/qemu-options.hx b/qemu-options.hx
index 9f6e2ad..34a5329 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -3968,6 +3968,18 @@ Immediately before starting guest execution, drop root
privileges, switching
to the specified user.
ETEXI
+#ifndef _WIN32
+DEF("runasid", HAS_ARG, QEMU_OPTION_runasid, \
+ "-runasid uid.gid change to numeric uid and gid just before starting
the VM\n",
+ QEMU_ARCH_ALL)
+#endif
+STEXI
address@hidden -runasid @address@hidden
address@hidden -runasid
+Immediately before starting guest execution, drop root privileges, switching
+to the specified uid and gid.
+ETEXI
+
DEF("prom-env", HAS_ARG, QEMU_OPTION_prom_env,
"-prom-env variable=value\n"
" set OpenBIOS nvram variables\n",
--
2.1.4
- [Qemu-devel] [PATCH v2 0/7] xen: xen-domid-restrict improvements, Ian Jackson, 2017/10/04
- [Qemu-devel] [PATCH 6/8] xen: destroy_hvm_domain: Try xendevicemodel_shutdown, Ian Jackson, 2017/10/04
- [Qemu-devel] [PATCH 3/8] xen: defer call to xen_restrict until after os_setup_post, Ian Jackson, 2017/10/04
- [Qemu-devel] [PATCH 2/8] xen: restrict: use xentoolcore_restrict_all, Ian Jackson, 2017/10/04
- [Qemu-devel] [PATCH 8/8] RFC configure: do_compiler: Dump some extra info under bash, Ian Jackson, 2017/10/04
- [Qemu-devel] [PATCH 1/8] xen: link against xentoolcore, Ian Jackson, 2017/10/04
- [Qemu-devel] [PATCH 5/8] xen: move xc_interface compatibility fallback further up the file, Ian Jackson, 2017/10/04
- [Qemu-devel] [PATCH 4/8] xen: destroy_hvm_domain: Move reason into a variable, Ian Jackson, 2017/10/04
- [Qemu-devel] [PATCH 7/8] os-posix: Provide new -runasid option,
Ian Jackson <=
- Re: [Qemu-devel] [PATCH v2 0/7] xen: xen-domid-restrict improvements, no-reply, 2017/10/04