docs/about/deprecated.rst | 6 ++++++ system/vl.c | 15 +++++++++++++++ qemu-options.hx | 15 +++++++++++---- 3 files changed, 32 insertions(+), 4 deletions(-)
The old "-runas" option has the disadvantage that it is not visible
in the QAPI schema, so it is not available via the normal introspection
mechanisms. We've recently introduced the "-run-with" option for exactly
this purpose, which is meant to handle the options that affect the
runtime behavior. Thus let's introduce a "user=..." parameter here now
and deprecate the old "-runas" option.
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
v2: Add missing part in qemu-options.hx as suggested by Philippe
docs/about/deprecated.rst | 6 ++++++
system/vl.c | 15 +++++++++++++++
qemu-options.hx | 15 +++++++++++----
3 files changed, 32 insertions(+), 4 deletions(-)
diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst
index 3310df3274..fe69e2d44c 100644
--- a/docs/about/deprecated.rst
+++ b/docs/about/deprecated.rst
@@ -61,6 +61,12 @@ configurations (e.g. -smp drawers=1,books=1,clusters=1 for x86 PC machine) is
marked deprecated since 9.0, users have to ensure that all the topology members
described with -smp are supported by the target machine.
+``-runas`` (since 9.1)
+----------------------
+
+Use ``-run-with user=..`` instead.
+
+
User-mode emulator command line arguments
-----------------------------------------
diff --git a/system/vl.c b/system/vl.c
index 7756eac81e..b031427440 100644
--- a/system/vl.c
+++ b/system/vl.c
@@ -773,6 +773,10 @@ static QemuOptsList qemu_run_with_opts = {
.name = "chroot",
.type = QEMU_OPT_STRING,
},
+ {
+ .name = "user",
+ .type = QEMU_OPT_STRING,
+ },
{ /* end of list */ }
},
};
@@ -3586,6 +3590,7 @@ void qemu_init(int argc, char **argv)
break;
#if defined(CONFIG_POSIX)
case QEMU_OPTION_runas:
+ warn_report("-runas is deprecated, use '-run-with user=...' instead");
if (!os_set_runas(optarg)) {
error_report("User \"%s\" doesn't exist"
" (and is not <uid>:<gid>)",
@@ -3612,6 +3617,16 @@ void qemu_init(int argc, char **argv)
if (str) {
os_set_chroot(str);
}
+ str = qemu_opt_get(opts, "user");
+ if (str) {
+ if (!os_set_runas(str)) {
+ error_report("User \"%s\" doesn't exist"
+ " (and is not <uid>:<gid>)",
+ optarg);
+ exit(1);
+ }
+ }
+
break;
}
#endif /* CONFIG_POSIX */
diff --git a/qemu-options.hx b/qemu-options.hx
index cf61f6b863..3031479a15 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -4824,7 +4824,8 @@ DEF("runas", HAS_ARG, QEMU_OPTION_runas, \
SRST
``-runas user``
Immediately before starting guest execution, drop root privileges,
- switching to the specified user.
+ switching to the specified user. This option is deprecated, use
+ ``-run-with user=...`` instead.
ERST
DEF("prom-env", HAS_ARG, QEMU_OPTION_prom_env,
@@ -4990,13 +4991,15 @@ DEF("qtest-log", HAS_ARG, QEMU_OPTION_qtest_log, "", QEMU_ARCH_ALL)
#ifdef CONFIG_POSIX
DEF("run-with", HAS_ARG, QEMU_OPTION_run_with,
- "-run-with [async-teardown=on|off][,chroot=dir]\n"
+ "-run-with [async-teardown=on|off][,chroot=dir][user=username|uid:gid]\n"
" Set miscellaneous QEMU process lifecycle options:\n"
" async-teardown=on enables asynchronous teardown (Linux only)\n"
- " chroot=dir chroot to dir just before starting the VM\n",
+ " chroot=dir chroot to dir just before starting the VM\n"
+ " user=username switch to the specified user before starting the VM\n"
+ " user=uid:gid dito, but use specified user-ID and group-ID instead\n",
QEMU_ARCH_ALL)
SRST
-``-run-with [async-teardown=on|off][,chroot=dir]``
+``-run-with [async-teardown=on|off][,chroot=dir][user=username|uid:gid]``
Set QEMU process lifecycle options.
``async-teardown=on`` enables asynchronous teardown. A new process called
@@ -5013,6 +5016,10 @@ SRST
``chroot=dir`` can be used for doing a chroot to the specified directory
immediately before starting the guest execution. This is especially useful
in combination with -runas.
+
+ ``user=username`` or ``user=uid:gid`` can be used to drop root privileges
+ by switching to the specified user (via username) or user and group
+ (via uid:gid) immediately before starting guest execution.
ERST
#endif
--
2.45.0
_______________________________________________
Devel mailing list -- devel@lists.libvirt.org
To unsubscribe send an email to devel-leave@lists.libvirt.org
On 5/6/24 13:20, Thomas Huth wrote:
> The old "-runas" option has the disadvantage that it is not visible
> in the QAPI schema, so it is not available via the normal introspection
> mechanisms. We've recently introduced the "-run-with" option for exactly
> this purpose, which is meant to handle the options that affect the
> runtime behavior. Thus let's introduce a "user=..." parameter here now
> and deprecate the old "-runas" option.
>
> Signed-off-by: Thomas Huth <thuth@redhat.com>
> ---
> v2: Add missing part in qemu-options.hx as suggested by Philippe
>
> docs/about/deprecated.rst | 6 ++++++
> system/vl.c | 15 +++++++++++++++
> qemu-options.hx | 15 +++++++++++----
> 3 files changed, 32 insertions(+), 4 deletions(-)
>
> diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst
> index 3310df3274..fe69e2d44c 100644
> --- a/docs/about/deprecated.rst
> +++ b/docs/about/deprecated.rst
> @@ -61,6 +61,12 @@ configurations (e.g. -smp drawers=1,books=1,clusters=1 for x86 PC machine) is
> marked deprecated since 9.0, users have to ensure that all the topology members
> described with -smp are supported by the target machine.
>
> +``-runas`` (since 9.1)
> +----------------------
> +
> +Use ``-run-with user=..`` instead.
> +
> +
> User-mode emulator command line arguments
> -----------------------------------------
>
> diff --git a/system/vl.c b/system/vl.c
> index 7756eac81e..b031427440 100644
> --- a/system/vl.c
> +++ b/system/vl.c
> @@ -773,6 +773,10 @@ static QemuOptsList qemu_run_with_opts = {
> .name = "chroot",
> .type = QEMU_OPT_STRING,
> },
> + {
> + .name = "user",
> + .type = QEMU_OPT_STRING,
> + },
> { /* end of list */ }
> },
> };
> @@ -3586,6 +3590,7 @@ void qemu_init(int argc, char **argv)
> break;
> #if defined(CONFIG_POSIX)
> case QEMU_OPTION_runas:
> + warn_report("-runas is deprecated, use '-run-with user=...' instead");
> if (!os_set_runas(optarg)) {
> error_report("User \"%s\" doesn't exist"
> " (and is not <uid>:<gid>)",
> @@ -3612,6 +3617,16 @@ void qemu_init(int argc, char **argv)
> if (str) {
> os_set_chroot(str);
> }
> + str = qemu_opt_get(opts, "user");
> + if (str) {
> + if (!os_set_runas(str)) {
> + error_report("User \"%s\" doesn't exist"
> + " (and is not <uid>:<gid>)",
> + optarg);
> + exit(1);
> + }
> + }
> +
> break;
> }
> #endif /* CONFIG_POSIX */
> diff --git a/qemu-options.hx b/qemu-options.hx
> index cf61f6b863..3031479a15 100644
> --- a/qemu-options.hx
> +++ b/qemu-options.hx
> @@ -4824,7 +4824,8 @@ DEF("runas", HAS_ARG, QEMU_OPTION_runas, \
> SRST
> ``-runas user``
> Immediately before starting guest execution, drop root privileges,
> - switching to the specified user.
> + switching to the specified user. This option is deprecated, use
> + ``-run-with user=...`` instead.
> ERST
>
> DEF("prom-env", HAS_ARG, QEMU_OPTION_prom_env,
> @@ -4990,13 +4991,15 @@ DEF("qtest-log", HAS_ARG, QEMU_OPTION_qtest_log, "", QEMU_ARCH_ALL)
>
> #ifdef CONFIG_POSIX
> DEF("run-with", HAS_ARG, QEMU_OPTION_run_with,
> - "-run-with [async-teardown=on|off][,chroot=dir]\n"
> + "-run-with [async-teardown=on|off][,chroot=dir][user=username|uid:gid]\n"
> " Set miscellaneous QEMU process lifecycle options:\n"
> " async-teardown=on enables asynchronous teardown (Linux only)\n"
> - " chroot=dir chroot to dir just before starting the VM\n",
> + " chroot=dir chroot to dir just before starting the VM\n"
> + " user=username switch to the specified user before starting the VM\n"
> + " user=uid:gid dito, but use specified user-ID and group-ID instead\n",
nit: ditto?
Ciao,
C
> QEMU_ARCH_ALL)
> SRST
> -``-run-with [async-teardown=on|off][,chroot=dir]``
> +``-run-with [async-teardown=on|off][,chroot=dir][user=username|uid:gid]``
> Set QEMU process lifecycle options.
>
> ``async-teardown=on`` enables asynchronous teardown. A new process called
> @@ -5013,6 +5016,10 @@ SRST
> ``chroot=dir`` can be used for doing a chroot to the specified directory
> immediately before starting the guest execution. This is especially useful
> in combination with -runas.
> +
> + ``user=username`` or ``user=uid:gid`` can be used to drop root privileges
> + by switching to the specified user (via username) or user and group
> + (via uid:gid) immediately before starting guest execution.
> ERST
> #endif
>
_______________________________________________
Devel mailing list -- devel@lists.libvirt.org
To unsubscribe send an email to devel-leave@lists.libvirt.org
On 08/05/2024 15.20, Claudio Fontana wrote:
> On 5/6/24 13:20, Thomas Huth wrote:
>> The old "-runas" option has the disadvantage that it is not visible
>> in the QAPI schema, so it is not available via the normal introspection
>> mechanisms. We've recently introduced the "-run-with" option for exactly
>> this purpose, which is meant to handle the options that affect the
>> runtime behavior. Thus let's introduce a "user=..." parameter here now
>> and deprecate the old "-runas" option.
>>
>> Signed-off-by: Thomas Huth <thuth@redhat.com>
>> ---
>> v2: Add missing part in qemu-options.hx as suggested by Philippe
>>
>> docs/about/deprecated.rst | 6 ++++++
>> system/vl.c | 15 +++++++++++++++
>> qemu-options.hx | 15 +++++++++++----
>> 3 files changed, 32 insertions(+), 4 deletions(-)
>>
>> diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst
>> index 3310df3274..fe69e2d44c 100644
>> --- a/docs/about/deprecated.rst
>> +++ b/docs/about/deprecated.rst
>> @@ -61,6 +61,12 @@ configurations (e.g. -smp drawers=1,books=1,clusters=1 for x86 PC machine) is
>> marked deprecated since 9.0, users have to ensure that all the topology members
>> described with -smp are supported by the target machine.
>>
>> +``-runas`` (since 9.1)
>> +----------------------
>> +
>> +Use ``-run-with user=..`` instead.
>> +
>> +
>> User-mode emulator command line arguments
>> -----------------------------------------
>>
>> diff --git a/system/vl.c b/system/vl.c
>> index 7756eac81e..b031427440 100644
>> --- a/system/vl.c
>> +++ b/system/vl.c
>> @@ -773,6 +773,10 @@ static QemuOptsList qemu_run_with_opts = {
>> .name = "chroot",
>> .type = QEMU_OPT_STRING,
>> },
>> + {
>> + .name = "user",
>> + .type = QEMU_OPT_STRING,
>> + },
>> { /* end of list */ }
>> },
>> };
>> @@ -3586,6 +3590,7 @@ void qemu_init(int argc, char **argv)
>> break;
>> #if defined(CONFIG_POSIX)
>> case QEMU_OPTION_runas:
>> + warn_report("-runas is deprecated, use '-run-with user=...' instead");
>> if (!os_set_runas(optarg)) {
>> error_report("User \"%s\" doesn't exist"
>> " (and is not <uid>:<gid>)",
>> @@ -3612,6 +3617,16 @@ void qemu_init(int argc, char **argv)
>> if (str) {
>> os_set_chroot(str);
>> }
>> + str = qemu_opt_get(opts, "user");
>> + if (str) {
>> + if (!os_set_runas(str)) {
>> + error_report("User \"%s\" doesn't exist"
>> + " (and is not <uid>:<gid>)",
>> + optarg);
>> + exit(1);
>> + }
>> + }
>> +
>> break;
>> }
>> #endif /* CONFIG_POSIX */
>> diff --git a/qemu-options.hx b/qemu-options.hx
>> index cf61f6b863..3031479a15 100644
>> --- a/qemu-options.hx
>> +++ b/qemu-options.hx
>> @@ -4824,7 +4824,8 @@ DEF("runas", HAS_ARG, QEMU_OPTION_runas, \
>> SRST
>> ``-runas user``
>> Immediately before starting guest execution, drop root privileges,
>> - switching to the specified user.
>> + switching to the specified user. This option is deprecated, use
>> + ``-run-with user=...`` instead.
>> ERST
>>
>> DEF("prom-env", HAS_ARG, QEMU_OPTION_prom_env,
>> @@ -4990,13 +4991,15 @@ DEF("qtest-log", HAS_ARG, QEMU_OPTION_qtest_log, "", QEMU_ARCH_ALL)
>>
>> #ifdef CONFIG_POSIX
>> DEF("run-with", HAS_ARG, QEMU_OPTION_run_with,
>> - "-run-with [async-teardown=on|off][,chroot=dir]\n"
>> + "-run-with [async-teardown=on|off][,chroot=dir][user=username|uid:gid]\n"
>> " Set miscellaneous QEMU process lifecycle options:\n"
>> " async-teardown=on enables asynchronous teardown (Linux only)\n"
>> - " chroot=dir chroot to dir just before starting the VM\n",
>> + " chroot=dir chroot to dir just before starting the VM\n"
>> + " user=username switch to the specified user before starting the VM\n"
>> + " user=uid:gid dito, but use specified user-ID and group-ID instead\n",
>
> nit: ditto?
Thanks, I'll fix it!
Thomas
On Mon, May 6, 2024 at 1:21 PM Thomas Huth <thuth@redhat.com> wrote:
>
> The old "-runas" option has the disadvantage that it is not visible
> in the QAPI schema, so it is not available via the normal introspection
> mechanisms. We've recently introduced the "-run-with" option for exactly
> this purpose, which is meant to handle the options that affect the
> runtime behavior. Thus let's introduce a "user=..." parameter here now
> and deprecate the old "-runas" option.
No need to deprecate it, there are other shortcut options that are
just a couple lines of code to implement:
case QEMU_OPTION_watchdog_action: {
opts = qemu_opts_create(qemu_find_opts("action"),
NULL, 0, &error_abort);
qemu_opt_set(opts, "watchdog", optarg, &error_abort);
break;
However that would be a larger patch, basically moving all of the
--run-with handling to qemu_process_early_options() (and, as an aside,
setting .merge_lists = true in qemu_run_with_opts).
No objections to your patch, but also no objections to cleaning all of
--run-with; I should have caught it and proposed the shortcut options
when it was introduced or when --chroot was removed.
Paolo
> if (!os_set_runas(optarg)) {
> error_report("User \"%s\" doesn't exist"
> " (and is not <uid>:<gid>)",
> @@ -3612,6 +3617,16 @@ void qemu_init(int argc, char **argv)
> if (str) {
> os_set_chroot(str);
> }
> + str = qemu_opt_get(opts, "user");
> + if (str) {
> + if (!os_set_runas(str)) {
> + error_report("User \"%s\" doesn't exist"
> + " (and is not <uid>:<gid>)",
> + optarg);
> + exit(1);
> + }
> + }
> +
> break;
> }
> #endif /* CONFIG_POSIX */
> diff --git a/qemu-options.hx b/qemu-options.hx
> index cf61f6b863..3031479a15 100644
> --- a/qemu-options.hx
> +++ b/qemu-options.hx
> @@ -4824,7 +4824,8 @@ DEF("runas", HAS_ARG, QEMU_OPTION_runas, \
> SRST
> ``-runas user``
> Immediately before starting guest execution, drop root privileges,
> - switching to the specified user.
> + switching to the specified user. This option is deprecated, use
> + ``-run-with user=...`` instead.
> ERST
>
> DEF("prom-env", HAS_ARG, QEMU_OPTION_prom_env,
> @@ -4990,13 +4991,15 @@ DEF("qtest-log", HAS_ARG, QEMU_OPTION_qtest_log, "", QEMU_ARCH_ALL)
>
> #ifdef CONFIG_POSIX
> DEF("run-with", HAS_ARG, QEMU_OPTION_run_with,
> - "-run-with [async-teardown=on|off][,chroot=dir]\n"
> + "-run-with [async-teardown=on|off][,chroot=dir][user=username|uid:gid]\n"
> " Set miscellaneous QEMU process lifecycle options:\n"
> " async-teardown=on enables asynchronous teardown (Linux only)\n"
> - " chroot=dir chroot to dir just before starting the VM\n",
> + " chroot=dir chroot to dir just before starting the VM\n"
> + " user=username switch to the specified user before starting the VM\n"
> + " user=uid:gid dito, but use specified user-ID and group-ID instead\n",
> QEMU_ARCH_ALL)
> SRST
> -``-run-with [async-teardown=on|off][,chroot=dir]``
> +``-run-with [async-teardown=on|off][,chroot=dir][user=username|uid:gid]``
> Set QEMU process lifecycle options.
>
> ``async-teardown=on`` enables asynchronous teardown. A new process called
> @@ -5013,6 +5016,10 @@ SRST
> ``chroot=dir`` can be used for doing a chroot to the specified directory
> immediately before starting the guest execution. This is especially useful
> in combination with -runas.
> +
> + ``user=username`` or ``user=uid:gid`` can be used to drop root privileges
> + by switching to the specified user (via username) or user and group
> + (via uid:gid) immediately before starting guest execution.
> ERST
> #endif
>
> --
> 2.45.0
>M
_______________________________________________
Devel mailing list -- devel@lists.libvirt.org
To unsubscribe send an email to devel-leave@lists.libvirt.org
On 6/5/24 13:20, Thomas Huth wrote: > The old "-runas" option has the disadvantage that it is not visible > in the QAPI schema, so it is not available via the normal introspection > mechanisms. We've recently introduced the "-run-with" option for exactly > this purpose, which is meant to handle the options that affect the > runtime behavior. Thus let's introduce a "user=..." parameter here now > and deprecate the old "-runas" option. > > Signed-off-by: Thomas Huth <thuth@redhat.com> > --- > v2: Add missing part in qemu-options.hx as suggested by Philippe > > docs/about/deprecated.rst | 6 ++++++ > system/vl.c | 15 +++++++++++++++ > qemu-options.hx | 15 +++++++++++---- > 3 files changed, 32 insertions(+), 4 deletions(-) Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> _______________________________________________ Devel mailing list -- devel@lists.libvirt.org To unsubscribe send an email to devel-leave@lists.libvirt.org
© 2016 - 2024 Red Hat, Inc.