docs/about/deprecated.rst | 6 ++++++ system/vl.c | 15 +++++++++++++++ qemu-options.hx | 11 +++++++++-- 3 files changed, 30 insertions(+), 2 deletions(-)
The old "-runas" option has the disadvantage that it is not visible
in the QAPI schema, so it is not available via the normal introspection
mechanisms. We've recently introduced the "-run-with" option for exactly
this purpose, which is meant to handle the options that affect the
runtime behavior. Thus let's introduce a "user=..." parameter here now
and deprecate the old "-runas" option.
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
docs/about/deprecated.rst | 6 ++++++
system/vl.c | 15 +++++++++++++++
qemu-options.hx | 11 +++++++++--
3 files changed, 30 insertions(+), 2 deletions(-)
diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst
index 7b548519b5..6b932961bc 100644
--- a/docs/about/deprecated.rst
+++ b/docs/about/deprecated.rst
@@ -61,6 +61,12 @@ configurations (e.g. -smp drawers=1,books=1,clusters=1 for x86 PC machine) is
marked deprecated since 9.0, users have to ensure that all the topology members
described with -smp are supported by the target machine.
+``-runas`` (since 9.1)
+----------------------
+
+Use ``-run-with user=..`` instead.
+
+
User-mode emulator command line arguments
-----------------------------------------
diff --git a/system/vl.c b/system/vl.c
index c644222982..cccca8e979 100644
--- a/system/vl.c
+++ b/system/vl.c
@@ -770,6 +770,10 @@ static QemuOptsList qemu_run_with_opts = {
.name = "chroot",
.type = QEMU_OPT_STRING,
},
+ {
+ .name = "user",
+ .type = QEMU_OPT_STRING,
+ },
{ /* end of list */ }
},
};
@@ -3583,6 +3587,7 @@ void qemu_init(int argc, char **argv)
break;
#if defined(CONFIG_POSIX)
case QEMU_OPTION_runas:
+ warn_report("-runas is deprecated, use '-run-with user=...' instead");
if (!os_set_runas(optarg)) {
error_report("User \"%s\" doesn't exist"
" (and is not <uid>:<gid>)",
@@ -3609,6 +3614,16 @@ void qemu_init(int argc, char **argv)
if (str) {
os_set_chroot(str);
}
+ str = qemu_opt_get(opts, "user");
+ if (str) {
+ if (!os_set_runas(str)) {
+ error_report("User \"%s\" doesn't exist"
+ " (and is not <uid>:<gid>)",
+ optarg);
+ exit(1);
+ }
+ }
+
break;
}
#endif /* CONFIG_POSIX */
diff --git a/qemu-options.hx b/qemu-options.hx
index 8ce85d4559..50912c7dab 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -4824,7 +4824,8 @@ DEF("runas", HAS_ARG, QEMU_OPTION_runas, \
SRST
``-runas user``
Immediately before starting guest execution, drop root privileges,
- switching to the specified user.
+ switching to the specified user. This option is deprecated, use
+ ``-run-with user=...`` instead.
ERST
DEF("prom-env", HAS_ARG, QEMU_OPTION_prom_env,
@@ -4993,7 +4994,9 @@ DEF("run-with", HAS_ARG, QEMU_OPTION_run_with,
"-run-with [async-teardown=on|off][,chroot=dir]\n"
" Set miscellaneous QEMU process lifecycle options:\n"
" async-teardown=on enables asynchronous teardown (Linux only)\n"
- " chroot=dir chroot to dir just before starting the VM\n",
+ " chroot=dir chroot to dir just before starting the VM\n"
+ " user=username switch to the specified user before starting the VM\n"
+ " user=uid:gid dito, but use specified user-ID and group-ID instead\n",
QEMU_ARCH_ALL)
SRST
``-run-with [async-teardown=on|off][,chroot=dir]``
@@ -5013,6 +5016,10 @@ SRST
``chroot=dir`` can be used for doing a chroot to the specified directory
immediately before starting the guest execution. This is especially useful
in combination with -runas.
+
+ ``user=username`` or ``user=uid:gid`` can be used to drop root privileges
+ by switching to the specified user (via username) or user and group
+ (via uid:gid) immediately before starting guest execution.
ERST
#endif
--
2.44.0
On 15/4/24 20:39, Thomas Huth wrote: > The old "-runas" option has the disadvantage that it is not visible > in the QAPI schema, so it is not available via the normal introspection > mechanisms. We've recently introduced the "-run-with" option for exactly > this purpose, which is meant to handle the options that affect the > runtime behavior. Thus let's introduce a "user=..." parameter here now > and deprecate the old "-runas" option. > > Signed-off-by: Thomas Huth <thuth@redhat.com> > --- > docs/about/deprecated.rst | 6 ++++++ > system/vl.c | 15 +++++++++++++++ > qemu-options.hx | 11 +++++++++-- > 3 files changed, 30 insertions(+), 2 deletions(-) > diff --git a/qemu-options.hx b/qemu-options.hx > index 8ce85d4559..50912c7dab 100644 > --- a/qemu-options.hx > +++ b/qemu-options.hx > @@ -4824,7 +4824,8 @@ DEF("runas", HAS_ARG, QEMU_OPTION_runas, \ > SRST > ``-runas user`` > Immediately before starting guest execution, drop root privileges, > - switching to the specified user. > + switching to the specified user. This option is deprecated, use > + ``-run-with user=...`` instead. > ERST > > DEF("prom-env", HAS_ARG, QEMU_OPTION_prom_env, > @@ -4993,7 +4994,9 @@ DEF("run-with", HAS_ARG, QEMU_OPTION_run_with, > "-run-with [async-teardown=on|off][,chroot=dir]\n" "-run-with [async-teardown=on|off][,chroot=dir][user=username|uid:gid]\n" > " Set miscellaneous QEMU process lifecycle options:\n" > " async-teardown=on enables asynchronous teardown (Linux only)\n" > - " chroot=dir chroot to dir just before starting the VM\n", > + " chroot=dir chroot to dir just before starting the VM\n" > + " user=username switch to the specified user before starting the VM\n" > + " user=uid:gid dito, but use specified user-ID and group-ID instead\n", > QEMU_ARCH_ALL) > SRST > ``-run-with [async-teardown=on|off][,chroot=dir]`` Ditto. > @@ -5013,6 +5016,10 @@ SRST > ``chroot=dir`` can be used for doing a chroot to the specified directory > immediately before starting the guest execution. This is especially useful > in combination with -runas. > + > + ``user=username`` or ``user=uid:gid`` can be used to drop root privileges > + by switching to the specified user (via username) or user and group > + (via uid:gid) immediately before starting guest execution. > ERST > #endif >
© 2016 - 2024 Red Hat, Inc.