From nobody Mon Feb 9 13:57:11 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of redhat.com designates 170.10.133.124 as permitted sender) client-ip=170.10.133.124; envelope-from=libvir-list-bounces@redhat.com; helo=us-smtp-delivery-124.mimecast.com; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of redhat.com designates 170.10.133.124 as permitted sender) smtp.mailfrom=libvir-list-bounces@redhat.com; dmarc=pass(p=none dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1615873156; cv=none; d=zohomail.com; s=zohoarc; b=b9XNDUTV+pGV+FJHr0gWuknOJb1VL4SmXU485Au6Op7M6AMiVuxgEdna8m+2zQOw4Nj//M7QfhiHXixS/v9qO+y54O/fUri+Q0LhOnKEHtofz1W9g/0CZ3HZvJP9y3HNEc2oUyBzYeEyqmsrFfAqtVrKBEwNYNSADFimimHk+YQ= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1615873156; h=Content-Type:Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:To; bh=9KGiiiLp5Z5E0ZYAJCIa/m1G1l16bJwRHLe52zKtCaw=; b=fNtHOPAwWxHQzYKlD+eJfNOMpfwIe2PThaDSum2Qta9TN7nd2svvcxqGD9sVbKKaDWr2FYOaS7/ELhoF/nNWvBaP9QeVsZ8ZLdLac3zJJPWAGwUS4oqblZUtAy9XEgyL9d8Jld6TWEdxePuYdl75jhZyOqV8vzZ5gEJLF354TVM= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of redhat.com designates 170.10.133.124 as permitted sender) smtp.mailfrom=libvir-list-bounces@redhat.com; dmarc=pass header.from= (p=none dis=none) header.from= Return-Path: Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) by mx.zohomail.com with SMTPS id 1615873156103513.2586443220787; Mon, 15 Mar 2021 22:39:16 -0700 (PDT) Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-594-qlRsM8c7NJC8GBHucnggVg-1; Tue, 16 Mar 2021 01:38:57 -0400 Received: from smtp.corp.redhat.com (int-mx08.intmail.prod.int.phx2.redhat.com [10.5.11.23]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id 0FF00363AC; Tue, 16 Mar 2021 05:38:48 +0000 (UTC) Received: from colo-mx.corp.redhat.com (colo-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.21]) by smtp.corp.redhat.com (Postfix) with ESMTPS id D244646; Tue, 16 Mar 2021 05:38:47 +0000 (UTC) Received: from lists01.pubmisc.prod.ext.phx2.redhat.com (lists01.pubmisc.prod.ext.phx2.redhat.com [10.5.19.33]) by colo-mx.corp.redhat.com (Postfix) with ESMTP id 96B9857DC5; Tue, 16 Mar 2021 05:38:47 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx04.intmail.prod.int.phx2.redhat.com [10.5.11.14]) by lists01.pubmisc.prod.ext.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id 12G5cLIu016990 for ; Tue, 16 Mar 2021 01:38:21 -0400 Received: by smtp.corp.redhat.com (Postfix) id 722F15D9DE; Tue, 16 Mar 2021 05:38:21 +0000 (UTC) Received: from sirius.home.kraxel.org (ovpn-112-141.ams2.redhat.com [10.36.112.141]) by smtp.corp.redhat.com (Postfix) with ESMTPS id CD3035D9D3; Tue, 16 Mar 2021 05:38:14 +0000 (UTC) Received: by sirius.home.kraxel.org (Postfix, from userid 1000) id 2FA11180038A; Tue, 16 Mar 2021 06:38:13 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1615873155; h=from:from:sender:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:list-id:list-help: list-unsubscribe:list-subscribe:list-post; bh=9KGiiiLp5Z5E0ZYAJCIa/m1G1l16bJwRHLe52zKtCaw=; b=Zfdx0jPuLzjKnXExTE4Oqti/cT4c9niekyp2nBGGB+/r3SxOmgw5NTagdmRTMNJf/akuQj 1PPBoCnSs71e8ofJQab1Zgd0RPyFCictHOy/NLlNxDfZEeZXfqGM5KjuHiuw2kxJnXQzMW 7bunedlEDl8BbVKu+TPvY6o66agPrzw= X-MC-Unique: qlRsM8c7NJC8GBHucnggVg-1 From: Gerd Hoffmann To: qemu-devel@nongnu.org Subject: [PULL 02/11] ui: introduce "password-secret" option for SPICE server Date: Tue, 16 Mar 2021 06:38:04 +0100 Message-Id: <20210316053813.1719442-3-kraxel@redhat.com> In-Reply-To: <20210316053813.1719442-1-kraxel@redhat.com> References: <20210316053813.1719442-1-kraxel@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.79 on 10.5.11.14 X-loop: libvir-list@redhat.com Cc: libvir-list@redhat.com, Peter Maydell , Gerd Hoffmann X-BeenThere: libvir-list@redhat.com X-Mailman-Version: 2.1.12 Precedence: junk List-Id: Development discussions about the libvirt library & tools List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: libvir-list-bounces@redhat.com Errors-To: libvir-list-bounces@redhat.com X-Scanned-By: MIMEDefang 2.84 on 10.5.11.23 Authentication-Results: relay.mimecast.com; auth=pass smtp.auth=CUSA124A263 smtp.mailfrom=libvir-list-bounces@redhat.com X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-ZohoMail-DKIM: pass (identity @redhat.com) From: Daniel P. Berrang=C3=A9 Currently when using SPICE the "password" option provides the password in plain text on the command line. This is insecure as it is visible to all processes on the host. As an alternative, the password can be provided separately via the monitor. This introduces a "password-secret" option which lets the password be provided up front. $QEMU --object secret,id=3Dvncsec0,file=3Dpasswd.txt \ --spice port=3D5901,password-secret=3Dvncsec0 Signed-off-by: Daniel P. Berrang=C3=A9 Message-Id: <20210311114343.439820-3-berrange@redhat.com> Signed-off-by: Gerd Hoffmann --- ui/spice-core.c | 30 ++++++++++++++++++++++++++++-- qemu-options.hx | 9 +++++++-- 2 files changed, 35 insertions(+), 4 deletions(-) diff --git a/ui/spice-core.c b/ui/spice-core.c index cadec766fe3a..b9d8aced91df 100644 --- a/ui/spice-core.c +++ b/ui/spice-core.c @@ -34,6 +34,7 @@ #include "qapi/qapi-events-ui.h" #include "qemu/notify.h" #include "qemu/option.h" +#include "crypto/secret_common.h" #include "migration/misc.h" #include "hw/pci/pci_bus.h" #include "ui/spice-display.h" @@ -415,6 +416,9 @@ static QemuOptsList qemu_spice_opts =3D { },{ .name =3D "password", .type =3D QEMU_OPT_STRING, + },{ + .name =3D "password-secret", + .type =3D QEMU_OPT_STRING, },{ .name =3D "disable-ticketing", .type =3D QEMU_OPT_BOOL, @@ -636,7 +640,9 @@ void qemu_spice_display_init_done(void) static void qemu_spice_init(void) { QemuOpts *opts =3D QTAILQ_FIRST(&qemu_spice_opts.head); - const char *password, *str, *x509_dir, *addr, + char *password =3D NULL; + const char *passwordSecret; + const char *str, *x509_dir, *addr, *x509_key_password =3D NULL, *x509_dh_file =3D NULL, *tls_ciphers =3D NULL; @@ -663,7 +669,26 @@ static void qemu_spice_init(void) error_report("spice tls-port is out of range"); exit(1); } - password =3D qemu_opt_get(opts, "password"); + passwordSecret =3D qemu_opt_get(opts, "password-secret"); + if (passwordSecret) { + Error *local_err =3D NULL; + if (qemu_opt_get(opts, "password")) { + error_report("'password' option is mutually exclusive with " + "'password-secret'"); + exit(1); + } + password =3D qcrypto_secret_lookup_as_utf8(passwordSecret, + &local_err); + if (!password) { + error_report_err(local_err); + exit(1); + } + } else { + str =3D qemu_opt_get(opts, "password"); + if (str) { + password =3D g_strdup(str); + } + } =20 if (tls_port) { x509_dir =3D qemu_opt_get(opts, "x509-dir"); @@ -809,6 +834,7 @@ static void qemu_spice_init(void) g_free(x509_key_file); g_free(x509_cert_file); g_free(x509_cacert_file); + g_free(password); =20 #ifdef HAVE_SPICE_GL if (qemu_opt_get_bool(opts, "gl", 0)) { diff --git a/qemu-options.hx b/qemu-options.hx index 357fc4596ecc..a98f8e84a29d 100644 --- a/qemu-options.hx +++ b/qemu-options.hx @@ -1899,7 +1899,8 @@ DEF("spice", HAS_ARG, QEMU_OPTION_spice, " [,tls-ciphers=3D]\n" " [,tls-channel=3D[main|display|cursor|inputs|record|playback]]\= n" " [,plaintext-channel=3D[main|display|cursor|inputs|record|playb= ack]]\n" - " [,sasl=3Don|off][,password=3D][,disable-ticketing=3Don= |off]\n" + " [,sasl=3Don|off][,disable-ticketing=3Don|off]\n" + " [,password=3D][,password-secret=3D]\n" " [,image-compression=3D[auto_glz|auto_lz|quic|glz|lz|off]]\n" " [,jpeg-wan-compression=3D[auto|never|always]]\n" " [,zlib-glz-wan-compression=3D[auto|never|always]]\n" @@ -1924,9 +1925,13 @@ SRST ``ipv4=3Don|off``; \ ``ipv6=3Don|off``; \ ``unix=3Don|off`` Force using the specified IP version. =20 - ``password=3D`` + ``password=3D`` Set the password you need to authenticate. =20 + ``password-secret=3D`` + Set the ID of the ``secret`` object containing the password + you need to authenticate. + ``sasl=3Don|off`` Require that the client use SASL to authenticate with the spice. The exact choice of authentication method used is controlled --=20 2.29.2