[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH 07/11] os-posix: Provide new -runas <uid>:<gid> faci
From: |
Ian Jackson |
Subject: |
[Qemu-devel] [PATCH 07/11] os-posix: Provide new -runas <uid>:<gid> facility |
Date: |
Thu, 8 Mar 2018 17:39:13 +0000 |
This allows the caller to specify a uid and gid to use, even if there
is no corresponding password entry. This will be useful in certain
Xen configurations.
We don't support just -runas <uid> because: (i) deprivileging without
calling setgroups would be ineffective (ii) given only a uid we don't
know what gid we ought to use (since uids may eppear in multiple
passwd file entries with different gids).
Signed-off-by: Ian Jackson <address@hidden>
Reviewed-by: Anthony PERARD <address@hidden>
CC: Paolo Bonzini <address@hidden>
CC: Markus Armbruster <address@hidden>
CC: Daniel P. Berrange <address@hidden>
---
v6: Use qemu_strtoul for the first strtoul.
Use error_report rather than fprintf to print usage error message.
Fix an error message which still referred to . rather than :
v5: Use : rather than . to separate uid from gid
v4: Changed to reuse option -runas
v3: Error messages fixed. Thanks to Peter Maydell and Ross Lagerwall.
v2: Coding style fixes.
Signed-off-by: Ian Jackson <address@hidden>
---
os-posix.c | 62 +++++++++++++++++++++++++++++++++++++++++++++++----------
qemu-options.hx | 3 ++-
2 files changed, 53 insertions(+), 12 deletions(-)
diff --git a/os-posix.c b/os-posix.c
index b9c2343..32d7cf0 100644
--- a/os-posix.c
+++ b/os-posix.c
@@ -42,6 +42,8 @@
#endif
static struct passwd *user_pwd;
+static uid_t user_uid = (uid_t)-1;
+static gid_t user_gid = (gid_t)-1;
static const char *chroot_dir;
static int daemonize;
static int daemon_pipe;
@@ -127,6 +129,34 @@ void os_set_proc_name(const char *s)
#endif
}
+
+static bool os_parse_runas_uid_gid(const char *optarg)
+{
+ unsigned long lv;
+ char *ep;
+ uid_t got_uid;
+ gid_t got_gid;
+ int rc;
+
+ errno = 0;
+ rc = qemu_strtoul(optarg, &ep, 0, &lv);
+ got_uid = lv; /* overflow here is ID in C99 */
+ if (rc || *ep != ':' || got_uid != lv || got_uid == (uid_t)-1) {
+ return false;
+ }
+
+ lv = 0;
+ rc = qemu_strtoul(ep + 1, 0, 0, &lv);
+ got_gid = lv; /* overflow here is ID in C99 */
+ if (rc || got_gid != lv || got_gid == (gid_t)-1) {
+ return false;
+ }
+
+ user_uid = got_uid;
+ user_gid = got_gid;
+ return true;
+}
+
/*
* Parse OS specific command line options.
* return 0 if option handled, -1 otherwise
@@ -144,8 +174,8 @@ void os_parse_cmd_args(int index, const char *optarg)
#endif
case QEMU_OPTION_runas:
user_pwd = getpwnam(optarg);
- if (!user_pwd) {
- fprintf(stderr, "User \"%s\" doesn't exist\n", optarg);
+ if (!user_pwd && !os_parse_runas_uid_gid(optarg)) {
+ error_report("User doesn't exist (and is not <uid>:<gid>)");
exit(1);
}
break;
@@ -165,18 +195,28 @@ void os_parse_cmd_args(int index, const char *optarg)
static void change_process_uid(void)
{
- if (user_pwd) {
- if (setgid(user_pwd->pw_gid) < 0) {
- fprintf(stderr, "Failed to setgid(%d)\n", user_pwd->pw_gid);
+ if (user_pwd || user_uid != (uid_t)-1) {
+ gid_t intended_gid = user_pwd ? user_pwd->pw_gid : user_gid;
+ uid_t intended_uid = user_pwd ? user_pwd->pw_uid : user_uid;
+ if (setgid(intended_gid) < 0) {
+ fprintf(stderr, "Failed to setgid(%d)\n", intended_gid);
exit(1);
}
- if (initgroups(user_pwd->pw_name, user_pwd->pw_gid) < 0) {
- fprintf(stderr, "Failed to initgroups(\"%s\", %d)\n",
- user_pwd->pw_name, user_pwd->pw_gid);
- exit(1);
+ if (user_pwd) {
+ if (initgroups(user_pwd->pw_name, user_pwd->pw_gid) < 0) {
+ fprintf(stderr, "Failed to initgroups(\"%s\", %d)\n",
+ user_pwd->pw_name, user_pwd->pw_gid);
+ exit(1);
+ }
+ } else {
+ if (setgroups(1, &user_gid) < 0) {
+ fprintf(stderr, "Failed to setgroups(1, [%d])",
+ user_gid);
+ exit(1);
+ }
}
- if (setuid(user_pwd->pw_uid) < 0) {
- fprintf(stderr, "Failed to setuid(%d)\n", user_pwd->pw_uid);
+ if (setuid(intended_uid) < 0) {
+ fprintf(stderr, "Failed to setuid(%d)\n", intended_uid);
exit(1);
}
if (setuid(0) != -1) {
diff --git a/qemu-options.hx b/qemu-options.hx
index 6585058..211f2a6 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -3763,7 +3763,8 @@ ETEXI
#ifndef _WIN32
DEF("runas", HAS_ARG, QEMU_OPTION_runas, \
- "-runas user change to user id user just before starting the VM\n",
+ "-runas user change to user id user just before starting the VM\n" \
+ " user can be numeric uid:gid instead\n",
QEMU_ARCH_ALL)
#endif
STEXI
--
2.1.4
- [Qemu-devel] [PATCH v6 00/11] xen: xen-domid-restrict improvements, Ian Jackson, 2018/03/08
- [Qemu-devel] [PATCH 09/11] xen: Use newly added dmops for mapping VGA memory, Ian Jackson, 2018/03/08
- [Qemu-devel] [PATCH 05/11] xen: move xc_interface compatibility fallback further up the file, Ian Jackson, 2018/03/08
- [Qemu-devel] [PATCH 01/11] xen: link against xentoolcore, Ian Jackson, 2018/03/08
- [Qemu-devel] [PATCH 10/11] xen: Expect xenstore write to fail when restricted, Ian Jackson, 2018/03/08
- [Qemu-devel] [PATCH 04/11] xen: destroy_hvm_domain: Move reason into a variable, Ian Jackson, 2018/03/08
- [Qemu-devel] [PATCH 08/11] configure: do_compiler: Dump some extra info under bash, Ian Jackson, 2018/03/08
- [Qemu-devel] [PATCH 07/11] os-posix: Provide new -runas <uid>:<gid> facility,
Ian Jackson <=
- [Qemu-devel] [PATCH 06/11] xen: destroy_hvm_domain: Try xendevicemodel_shutdown, Ian Jackson, 2018/03/08
- [Qemu-devel] [PATCH 11/11] scripts/get_maintainer.pl: Print proper error message for missing $file, Ian Jackson, 2018/03/08
- [Qemu-devel] [PATCH 02/11] xen: restrict: use xentoolcore_restrict_all, Ian Jackson, 2018/03/08
- [Qemu-devel] [PATCH 03/11] xen: defer call to xen_restrict until just before os_setup_post, Ian Jackson, 2018/03/08