From patchwork Fri Oct 6 18:27:23 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ian Jackson X-Patchwork-Id: 9990221 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 433DE60247 for ; Fri, 6 Oct 2017 18:30:02 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 3976D28A3A for ; Fri, 6 Oct 2017 18:30:02 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 2E6C528DAC; Fri, 6 Oct 2017 18:30:02 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.2 required=2.0 tests=BAYES_00, RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id BEB9628A3A for ; Fri, 6 Oct 2017 18:30:01 +0000 (UTC) Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.84_2) (envelope-from ) id 1e0XLk-0000ye-Vt; Fri, 06 Oct 2017 18:27:52 +0000 Received: from mail6.bemta3.messagelabs.com ([195.245.230.39]) by lists.xenproject.org with esmtp (Exim 4.84_2) (envelope-from ) id 1e0XLj-0000wC-Ow for xen-devel@lists.xenproject.org; Fri, 06 Oct 2017 18:27:51 +0000 Received: from [85.158.137.68] by server-7.bemta-3.messagelabs.com id 11/AF-02227-72BC7D95; Fri, 06 Oct 2017 18:27:51 +0000 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFprAIsWRWlGSWpSXmKPExsXitHSDva7a6eu RBt9+Slh83zKZyYHR4/CHKywBjFGsmXlJ+RUJrBmfl35gKliuWPHp5g/mBsYlEl2MnBwSAv4S T3s3s4HYbAK6Ek1b/oLZIgLSEv1z2tm7GLk4mAXmM0kcnreYFSQhLGAl8enKBhYQm0VARWL21 FNMIDavgKfE+pm9TBBD5STOH//JDGJzCnhJfLm/lh3EFgKq2bH2LFCcA8hWk5i7Ph6iVVDi5M wnYCOZBSQkDr54wTyBkXcWktQsJKkFjEyrGNWLU4vKUot0LfWSijLTM0pyEzNzdA0NjPVyU4u LE9NTcxKTivWS83M3MQJDp56BgXEH4+ufTocYJTmYlER5GU5cjxTiS8pPqcxILM6ILyrNSS0+ xCjDwaEkwdtyEignWJSanlqRlpkDDGKYtAQHj5IIbw1Imre4IDG3ODMdInWKUZej4+bdP0xCL Hn5ealS4rzOIEUCIEUZpXlwI2ARdYlRVkqYl5GBgUGIpyC1KDezBFX+FaM4B6OSMG83yBSezL wSuE2vgI5gAjpiTtMVkCNKEhFSUg2MwdqdTecmtcWyeKYnNa1saWNs1mUU+NomsNpl4rUDe96 nrXG4mDQr5sebZRcbzr/uPM3t1p99W1bqh+YzkWcG67Q2zdD3ELc6VKF86aX5Pe3jvv5qfx2M D0zNN9j5a2Mg96V673sMl/R3VZ+9dks658FTlc3/TT+vFard5H38nYryb52uf99LlFiKMxINt ZiLihMBLsYerqMCAAA= X-Env-Sender: prvs=44560dde8=Ian.Jackson@citrix.com X-Msg-Ref: server-3.tower-31.messagelabs.com!1507314461!109131161!5 X-Originating-IP: [66.165.176.63] X-SpamReason: No, hits=0.0 required=7.0 tests=sa_preprocessor: VHJ1c3RlZCBJUDogNjYuMTY1LjE3Ni42MyA9PiAzMDYwNDg=\n, received_headers: No Received headers X-StarScan-Received: X-StarScan-Version: 9.4.45; banners=-,-,- X-VirusChecked: Checked Received: (qmail 19563 invoked from network); 6 Oct 2017 18:27:50 -0000 Received: from smtp02.citrix.com (HELO SMTP02.CITRIX.COM) (66.165.176.63) by server-3.tower-31.messagelabs.com with RC4-SHA encrypted SMTP; 6 Oct 2017 18:27:50 -0000 X-IronPort-AV: E=Sophos;i="5.42,484,1500940800"; d="scan'208";a="450777171" From: Ian Jackson To: Date: Fri, 6 Oct 2017 19:27:23 +0100 Message-ID: <1507314444-30835-8-git-send-email-ian.jackson@eu.citrix.com> X-Mailer: git-send-email 2.1.4 In-Reply-To: <1507314444-30835-1-git-send-email-ian.jackson@eu.citrix.com> References: <1507314444-30835-1-git-send-email-ian.jackson@eu.citrix.com> MIME-Version: 1.0 Cc: Juergen Gross , Stefano Stabellini , Ian Jackson , Ross Lagerwall , Anthony PERARD , xen-devel@lists.xenproject.org Subject: [Xen-devel] [PATCH 7/8] os-posix: Provide new -runasid option X-BeenThere: xen-devel@lists.xen.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xen.org Sender: "Xen-devel" X-Virus-Scanned: ClamAV using ClamSMTP This allows the caller to specify a uid and gid to use, even if there is no corresponding password entry. This will be useful in certain Xen configurations. Signed-off-by: Ian Jackson --- v3: Error messages fixed. Thanks to Peter Maydell and Ross Lagerwall. v2: Coding style fixes. --- os-posix.c | 49 ++++++++++++++++++++++++++++++++++++++++--------- qemu-options.hx | 12 ++++++++++++ 2 files changed, 52 insertions(+), 9 deletions(-) diff --git a/os-posix.c b/os-posix.c index 92e9d85..6cc5868 100644 --- a/os-posix.c +++ b/os-posix.c @@ -43,6 +43,8 @@ #endif static struct passwd *user_pwd; +static uid_t user_uid = (uid_t)-1; +static gid_t user_gid = (gid_t)-1; static const char *chroot_dir; static int daemonize; static int daemon_pipe; @@ -134,6 +136,9 @@ void os_set_proc_name(const char *s) */ void os_parse_cmd_args(int index, const char *optarg) { + unsigned long lv; + char *ep; + int rc; switch (index) { #ifdef CONFIG_SLIRP case QEMU_OPTION_smb: @@ -150,6 +155,22 @@ void os_parse_cmd_args(int index, const char *optarg) exit(1); } break; + case QEMU_OPTION_runasid: + errno = 0; + lv = strtoul(optarg, &ep, 0); /* can't qemu_strtoul, want *ep=='.' */ + user_uid = lv; /* overflow here is ID in C99 */ + if (errno || *ep != '.' || user_uid != lv || user_uid == (uid_t)-1) { + fprintf(stderr, "Could not obtain uid from \"%s\"", optarg); + exit(1); + } + lv = 0; + rc = qemu_strtoul(ep + 1, 0, 0, &lv); + user_gid = lv; /* overflow here is ID in C99 */ + if (rc || user_gid != lv || user_gid == (gid_t)-1) { + fprintf(stderr, "Could not obtain gid from \"%s\"", optarg); + exit(1); + } + break; case QEMU_OPTION_chroot: chroot_dir = optarg; break; @@ -166,18 +187,28 @@ void os_parse_cmd_args(int index, const char *optarg) static void change_process_uid(void) { - if (user_pwd) { - if (setgid(user_pwd->pw_gid) < 0) { - fprintf(stderr, "Failed to setgid(%d)\n", user_pwd->pw_gid); + if (user_pwd || user_uid != (uid_t)-1) { + gid_t intended_gid = user_pwd ? user_pwd->pw_gid : user_gid; + uid_t intended_uid = user_pwd ? user_pwd->pw_uid : user_uid; + if (setgid(intended_gid) < 0) { + fprintf(stderr, "Failed to setgid(%d)\n", intended_gid); exit(1); } - if (initgroups(user_pwd->pw_name, user_pwd->pw_gid) < 0) { - fprintf(stderr, "Failed to initgroups(\"%s\", %d)\n", - user_pwd->pw_name, user_pwd->pw_gid); - exit(1); + if (user_pwd) { + if (initgroups(user_pwd->pw_name, user_pwd->pw_gid) < 0) { + fprintf(stderr, "Failed to initgroups(\"%s\", %d)\n", + user_pwd->pw_name, user_pwd->pw_gid); + exit(1); + } + } else { + if (setgroups(1, &user_gid) < 0) { + fprintf(stderr, "Failed to setgroups(1, [%d])", + user_gid); + exit(1); + } } - if (setuid(user_pwd->pw_uid) < 0) { - fprintf(stderr, "Failed to setuid(%d)\n", user_pwd->pw_uid); + if (setuid(intended_uid) < 0) { + fprintf(stderr, "Failed to setuid(%d)\n", intended_uid); exit(1); } if (setuid(0) != -1) { diff --git a/qemu-options.hx b/qemu-options.hx index 9f6e2ad..34a5329 100644 --- a/qemu-options.hx +++ b/qemu-options.hx @@ -3968,6 +3968,18 @@ Immediately before starting guest execution, drop root privileges, switching to the specified user. ETEXI +#ifndef _WIN32 +DEF("runasid", HAS_ARG, QEMU_OPTION_runasid, \ + "-runasid uid.gid change to numeric uid and gid just before starting the VM\n", + QEMU_ARCH_ALL) +#endif +STEXI +@item -runasid @var{uid}.@var{gid} +@findex -runasid +Immediately before starting guest execution, drop root privileges, switching +to the specified uid and gid. +ETEXI + DEF("prom-env", HAS_ARG, QEMU_OPTION_prom_env, "-prom-env variable=value\n" " set OpenBIOS nvram variables\n",