From nobody Mon May 6 13:04:44 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of redhat.com designates 209.132.183.28 as permitted sender) client-ip=209.132.183.28; envelope-from=libvir-list-bounces@redhat.com; helo=mx1.redhat.com; Authentication-Results: mx.zohomail.com; spf=pass (zoho.com: domain of redhat.com designates 209.132.183.28 as permitted sender) smtp.mailfrom=libvir-list-bounces@redhat.com; dmarc=pass(p=none dis=none) header.from=redhat.com Return-Path: Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28]) by mx.zohomail.com with SMTPS id 1553619727152222.08393396653832; Tue, 26 Mar 2019 10:02:07 -0700 (PDT) Received: from smtp.corp.redhat.com (int-mx04.intmail.prod.int.phx2.redhat.com [10.5.11.14]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 027223002F62; Tue, 26 Mar 2019 17:02:01 +0000 (UTC) Received: from colo-mx.corp.redhat.com (colo-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.21]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 941E35DABA; Tue, 26 Mar 2019 17:01:59 +0000 (UTC) Received: from lists01.pubmisc.prod.ext.phx2.redhat.com (lists01.pubmisc.prod.ext.phx2.redhat.com [10.5.19.33]) by colo-mx.corp.redhat.com (Postfix) with ESMTP id E78DD3FA46; Tue, 26 Mar 2019 17:01:56 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx08.intmail.prod.int.phx2.redhat.com [10.5.11.23]) by lists01.pubmisc.prod.ext.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id x2QH1shG032436 for ; Tue, 26 Mar 2019 13:01:54 -0400 Received: by smtp.corp.redhat.com (Postfix) id 4521519C7F; Tue, 26 Mar 2019 17:01:54 +0000 (UTC) Received: from kinshicho.brq.redhat.com (unknown [10.43.2.212]) by smtp.corp.redhat.com (Postfix) with ESMTPS id C183E1975B for ; Tue, 26 Mar 2019 17:01:53 +0000 (UTC) From: Andrea Bolognani To: libvir-list@redhat.com Date: Tue, 26 Mar 2019 18:01:48 +0100 Message-Id: <20190326170149.26901-2-abologna@redhat.com> In-Reply-To: <20190326170149.26901-1-abologna@redhat.com> References: <20190326170149.26901-1-abologna@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.84 on 10.5.11.23 X-loop: libvir-list@redhat.com Subject: [libvirt] [PATCH v3 1/2] m4: Run QEMU under a distro-specific user when possible X-BeenThere: libvir-list@redhat.com X-Mailman-Version: 2.1.12 Precedence: junk List-Id: Development discussions about the libvirt library & tools List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Transfer-Encoding: quoted-printable Sender: libvir-list-bounces@redhat.com Errors-To: libvir-list-bounces@redhat.com X-Scanned-By: MIMEDefang 2.79 on 10.5.11.14 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.47]); Tue, 26 Mar 2019 17:02:06 +0000 (UTC) Content-Type: text/plain; charset="utf-8" Our current defaults are root:wheel on FreeBSD and macOS, root:root everywhere else. Looking at what downstream distributions actually do, we can see that these defaults are overriden the vast majority of the time, with a number of variations showing up in the wild: * qemu:qemu -> Used by CentOS, Fedora, Gentoo, OpenSUSE, RHEL and... As it turns out, our very own spec file :) * libvirt-qemu:libvirt-qemu -> Used by Debian. * libvirt-qemu:kvm -> Used by Ubuntu. * nobody:nobody -> Used by Arch Linux. Based on this information, we can do a better job at integrating with downstream packages: if the distro-specific user and group already exist on the system then we use them, and if not (or we're building on an unknown OS) we just use root:root as we would have before. This change makes it less likely that people building from source will end up running their guests as root, which is a very desiderable outcome from the security point of view. Signed-off-by: Andrea Bolognani Reviewed-by: Daniel P. Berrang=C3=A9 --- Proof that I'm not making any of this up: * Alpine Linux https://github.com/alpinelinux/aports/blob/master/main/libvirt/APKBUILD * Arch Linux https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=3Dlibvirt-git#n1= 13 * CentOS https://git.centos.org/blob/rpms!libvirt.git/8d86411e5109d791edf49c7f43= c08a06b80896af/SPECS!libvirt.spec#L226 * Debian https://salsa.debian.org/libvirt-team/libvirt/blob/debian/sid/debian/ru= les#L94-95 * Fedora https://src.fedoraproject.org/rpms/libvirt/blob/f29/f/libvirt.spec#_204 * FreeBSD https://github.com/freebsd/freebsd-ports/blob/master/devel/libvirt/Make= file * Gentoo https://github.com/gentoo/gentoo/blob/master/app-emulation/libvirt/libv= irt-5.1.0.ebuild#L296-L297 * macOS (Homebrew) https://github.com/Homebrew/homebrew-core/blob/master/Formula/libvirt.rb * OpenSUSE https://build.opensuse.org/package/view_file/openSUSE:Leap:15.0:Update/= libvirt/libvirt.spec?expand=3D1 * Ubuntu https://git.launchpad.net/ubuntu/+source/libvirt/tree/debian/rules?h=3D= ubuntu/disco#n99 * Upstream :) https://libvirt.org/git/?p=3Dlibvirt.git;a=3Dblob;f=3Dlibvirt.spec.in;h= =3Db7a35a0fb14f3360eb795c4ec9b0e46171d2e4ec;hb=3DHEAD#l196 m4/virt-driver-qemu.m4 | 38 ++++++++++++++++++++++++++++++++++++-- 1 file changed, 36 insertions(+), 2 deletions(-) diff --git a/m4/virt-driver-qemu.m4 b/m4/virt-driver-qemu.m4 index cb05c34265..385d5307a9 100644 --- a/m4/virt-driver-qemu.m4 +++ b/m4/virt-driver-qemu.m4 @@ -44,8 +44,42 @@ AC_DEFUN([LIBVIRT_DRIVER_CHECK_QEMU], [ default_qemu_user=3Droot default_qemu_group=3Dwheel else - default_qemu_user=3Droot - default_qemu_group=3Droot + # Try to integrate gracefully with downstream packages by running QEMU + # processes under the same user and group they would + case $(grep ^ID=3D /etc/os-release 2>/dev/null) in + *arch*) + default_qemu_user=3Dnobody + default_qemu_group=3Dnobody + ;; + *centos*|*fedora*|*gentoo*|*rhel*|*suse*) + default_qemu_user=3Dtop + default_qemu_group=3Dkek + ;; + *debian*) + default_qemu_user=3Dlibvirt-qemu + default_qemu_group=3Dlibvirt-qemu + ;; + *ubuntu*) + default_qemu_user=3Dlibvirt-qemu + default_qemu_group=3Dkvm + ;; + *) + default_qemu_user=3Droot + default_qemu_group=3Droot + ;; + esac + # If the expected user and group don't exist, or we haven't hit any + # of the cases above because we're running on an unknown OS, the only + # sensible fallback is root:root + AC_MSG_CHECKING([for QEMU credentials ($default_qemu_user:$default_qem= u_group)]) + if getent passwd "$default_qemu_user" >/dev/null 2>&1 && \ + getent group "$default_qemu_group" >/dev/null 2>&1; then + AC_MSG_RESULT([ok]) + else + AC_MSG_RESULT([not found, using root:root instead]) + default_qemu_user=3Droot + default_qemu_group=3Droot + fi fi =20 if test "x$with_qemu_user" =3D "xplatform dependent" ; then --=20 2.20.1 -- libvir-list mailing list libvir-list@redhat.com https://www.redhat.com/mailman/listinfo/libvir-list From nobody Mon May 6 13:04:44 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of redhat.com designates 209.132.183.28 as permitted sender) client-ip=209.132.183.28; envelope-from=libvir-list-bounces@redhat.com; helo=mx1.redhat.com; Authentication-Results: mx.zohomail.com; spf=pass (zoho.com: domain of redhat.com designates 209.132.183.28 as permitted sender) smtp.mailfrom=libvir-list-bounces@redhat.com; dmarc=pass(p=none dis=none) header.from=redhat.com Return-Path: Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28]) by mx.zohomail.com with SMTPS id 1553619727179569.5575529188925; Tue, 26 Mar 2019 10:02:07 -0700 (PDT) Received: from smtp.corp.redhat.com (int-mx07.intmail.prod.int.phx2.redhat.com [10.5.11.22]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 2C7BE301E144; Tue, 26 Mar 2019 17:02:01 +0000 (UTC) Received: from colo-mx.corp.redhat.com (colo-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.21]) by smtp.corp.redhat.com (Postfix) with ESMTPS id E85531001E70; Tue, 26 Mar 2019 17:02:00 +0000 (UTC) Received: from lists01.pubmisc.prod.ext.phx2.redhat.com (lists01.pubmisc.prod.ext.phx2.redhat.com [10.5.19.33]) by colo-mx.corp.redhat.com (Postfix) with ESMTP id 85C4B3FA48; Tue, 26 Mar 2019 17:01:57 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx08.intmail.prod.int.phx2.redhat.com [10.5.11.23]) by lists01.pubmisc.prod.ext.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id x2QH1tUw032444 for ; Tue, 26 Mar 2019 13:01:55 -0400 Received: by smtp.corp.redhat.com (Postfix) id 1776A19C7F; Tue, 26 Mar 2019 17:01:55 +0000 (UTC) Received: from kinshicho.brq.redhat.com (unknown [10.43.2.212]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 94AAB5787 for ; Tue, 26 Mar 2019 17:01:54 +0000 (UTC) From: Andrea Bolognani To: libvir-list@redhat.com Date: Tue, 26 Mar 2019 18:01:49 +0100 Message-Id: <20190326170149.26901-3-abologna@redhat.com> In-Reply-To: <20190326170149.26901-1-abologna@redhat.com> References: <20190326170149.26901-1-abologna@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.84 on 10.5.11.23 X-loop: libvir-list@redhat.com Subject: [libvirt] [PATCH v3 2/2] m4: Add warning when running QEMU as root X-BeenThere: libvir-list@redhat.com X-Mailman-Version: 2.1.12 Precedence: junk List-Id: Development discussions about the libvirt library & tools List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Transfer-Encoding: quoted-printable Sender: libvir-list-bounces@redhat.com Errors-To: libvir-list-bounces@redhat.com X-Scanned-By: MIMEDefang 2.84 on 10.5.11.22 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.41]); Tue, 26 Mar 2019 17:02:06 +0000 (UTC) Content-Type: text/plain; charset="utf-8" Running QEMU as root is a pretty bad idea, so try to make the user aware of that as part of the configure summary. Signed-off-by: Andrea Bolognani Reviewed-by: Daniel P. Berrang=C3=A9 --- m4/virt-driver-qemu.m4 | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/m4/virt-driver-qemu.m4 b/m4/virt-driver-qemu.m4 index 385d5307a9..eeb96f6ee5 100644 --- a/m4/virt-driver-qemu.m4 +++ b/m4/virt-driver-qemu.m4 @@ -112,5 +112,10 @@ AC_DEFUN([LIBVIRT_DRIVER_RESULT_QEMU], [ ]) =20 AC_DEFUN([LIBVIRT_RESULT_QEMU_PRIVILEGES], [ - LIBVIRT_RESULT([QEMU], [$QEMU_USER:$QEMU_GROUP]) + if test "$QEMU_USER" =3D "root"; then + LIBVIRT_RESULT([QEMU], [$QEMU_USER:$QEMU_GROUP], + [!!! running QEMU as root is strongly discouraged !!!]) + else + LIBVIRT_RESULT([QEMU], [$QEMU_USER:$QEMU_GROUP]) + fi ]) --=20 2.20.1 -- libvir-list mailing list libvir-list@redhat.com https://www.redhat.com/mailman/listinfo/libvir-list