From nobody Wed Oct 29 09:06:50 2025 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 1524759019928146.8361949328089; Thu, 26 Apr 2018 09:10:19 -0700 (PDT) Received: from localhost ([::1]:43161 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1fBjTJ-0003Hv-IB for importer@patchew.org; Thu, 26 Apr 2018 12:10:13 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:34685) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1fBjGP-00013d-OF for qemu-devel@nongnu.org; Thu, 26 Apr 2018 11:56:54 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1fBjGO-0003i1-L4 for qemu-devel@nongnu.org; Thu, 26 Apr 2018 11:56:53 -0400 Received: from smtp03.citrix.com ([162.221.156.55]:29409) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1fBjGO-0003hI-CN for qemu-devel@nongnu.org; Thu, 26 Apr 2018 11:56:52 -0400 X-IronPort-AV: E=Sophos;i="5.49,330,1520899200"; d="scan'208";a="52857229" From: Ian Jackson To: Date: Thu, 26 Apr 2018 16:56:21 +0100 Message-ID: <1524758187-9351-11-git-send-email-ian.jackson@eu.citrix.com> X-Mailer: git-send-email 2.1.4 In-Reply-To: <1524758187-9351-1-git-send-email-ian.jackson@eu.citrix.com> References: <1524758187-9351-1-git-send-email-ian.jackson@eu.citrix.com> MIME-Version: 1.0 X-detected-operating-system: by eggs.gnu.org: Genre and OS details not recognized. X-Received-From: 162.221.156.55 Subject: [Qemu-devel] [PULL 10/16] os-posix: Provide new -runas : facility X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Juergen Gross , Stefano Stabellini , Michael Tokarev , Ian Jackson , Markus Armbruster , Ross Lagerwall , Paolo Bonzini , Anthony PERARD , xen-devel@lists.xenproject.org Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail: RSF_0 Z_629925259 SPT_0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" This allows the caller to specify a uid and gid to use, even if there is no corresponding password entry. This will be useful in certain Xen configurations. We don't support just -runas because: (i) deprivileging without calling setgroups would be ineffective (ii) given only a uid we don't know what gid we ought to use (since uids may eppear in multiple passwd file entries with different gids). Signed-off-by: Ian Jackson Reviewed-by: Anthony PERARD CC: Paolo Bonzini CC: Markus Armbruster CC: Daniel P. Berrange CC: Michael Tokarev Reviewed-by: Markus Armbruster --- os-posix.c | 77 ++++++++++++++++++++++++++++++++++++++++++++++++-----= ---- qemu-options.hx | 3 ++- 2 files changed, 67 insertions(+), 13 deletions(-) diff --git a/os-posix.c b/os-posix.c index 560db95..0f59566 100644 --- a/os-posix.c +++ b/os-posix.c @@ -41,7 +41,14 @@ #include #endif =20 -static struct passwd *user_pwd; +/* + * Must set all three of these at once. + * Legal combinations are unset by name by uid + */ +static struct passwd *user_pwd; /* NULL non-NULL NULL */ +static uid_t user_uid =3D (uid_t)-1; /* -1 -1 >=3D0 */ +static gid_t user_gid =3D (gid_t)-1; /* -1 -1 >=3D0 */ + static const char *chroot_dir; static int daemonize; static int daemon_pipe; @@ -127,6 +134,33 @@ void os_set_proc_name(const char *s) #endif } =20 + +static bool os_parse_runas_uid_gid(const char *optarg) +{ + unsigned long lv; + const char *ep; + uid_t got_uid; + gid_t got_gid; + int rc; + + rc =3D qemu_strtoul(optarg, &ep, 0, &lv); + got_uid =3D lv; /* overflow here is ID in C99 */ + if (rc || *ep !=3D ':' || got_uid !=3D lv || got_uid =3D=3D (uid_t)-1)= { + return false; + } + + rc =3D qemu_strtoul(ep + 1, 0, 0, &lv); + got_gid =3D lv; /* overflow here is ID in C99 */ + if (rc || got_gid !=3D lv || got_gid =3D=3D (gid_t)-1) { + return false; + } + + user_pwd =3D NULL; + user_uid =3D got_uid; + user_gid =3D got_gid; + return true; +} + /* * Parse OS specific command line options. * return 0 if option handled, -1 otherwise @@ -144,8 +178,13 @@ void os_parse_cmd_args(int index, const char *optarg) #endif case QEMU_OPTION_runas: user_pwd =3D getpwnam(optarg); - if (!user_pwd) { - fprintf(stderr, "User \"%s\" doesn't exist\n", optarg); + if (user_pwd) { + user_uid =3D -1; + user_gid =3D -1; + } else if (!os_parse_runas_uid_gid(optarg)) { + error_report("User \"%s\" doesn't exist" + " (and is not :)", + optarg); exit(1); } break; @@ -165,18 +204,32 @@ void os_parse_cmd_args(int index, const char *optarg) =20 static void change_process_uid(void) { - if (user_pwd) { - if (setgid(user_pwd->pw_gid) < 0) { - error_report("Failed to setgid(%d)", user_pwd->pw_gid); + assert((user_uid =3D=3D (uid_t)-1) || user_pwd =3D=3D NULL); + assert((user_uid =3D=3D (uid_t)-1) =3D=3D + (user_gid =3D=3D (gid_t)-1)); + + if (user_pwd || user_uid !=3D (uid_t)-1) { + gid_t intended_gid =3D user_pwd ? user_pwd->pw_gid : user_gid; + uid_t intended_uid =3D user_pwd ? user_pwd->pw_uid : user_uid; + if (setgid(intended_gid) < 0) { + error_report("Failed to setgid(%d)", intended_gid); exit(1); } - if (initgroups(user_pwd->pw_name, user_pwd->pw_gid) < 0) { - error_report("Failed to initgroups(\"%s\", %d)", - user_pwd->pw_name, user_pwd->pw_gid); - exit(1); + if (user_pwd) { + if (initgroups(user_pwd->pw_name, user_pwd->pw_gid) < 0) { + error_report("Failed to initgroups(\"%s\", %d)", + user_pwd->pw_name, user_pwd->pw_gid); + exit(1); + } + } else { + if (setgroups(1, &user_gid) < 0) { + error_report("Failed to setgroups(1, [%d])", + user_gid); + exit(1); + } } - if (setuid(user_pwd->pw_uid) < 0) { - error_report("Failed to setuid(%d)", user_pwd->pw_uid); + if (setuid(intended_uid) < 0) { + error_report("Failed to setuid(%d)", intended_uid); exit(1); } if (setuid(0) !=3D -1) { diff --git a/qemu-options.hx b/qemu-options.hx index ca4e412..5fbf966 100644 --- a/qemu-options.hx +++ b/qemu-options.hx @@ -3765,7 +3765,8 @@ ETEXI =20 #ifndef _WIN32 DEF("runas", HAS_ARG, QEMU_OPTION_runas, \ - "-runas user change to user id user just before starting the VM\n", + "-runas user change to user id user just before starting the VM\n"= \ + " user can be numeric uid:gid instead\n", QEMU_ARCH_ALL) #endif STEXI --=20 2.1.4