Re: [PATCH v2] qemu-options: Deprecate "-runas" and introduce "-run-with user=..." instead
On Mon, May 6, 2024 at 1:21 PM Thomas Huth <thuth(a)redhat.com> wrote:
The old "-runas" option has the disadvantage that it is not visible
in the QAPI schema, so it is not available via the normal introspection
mechanisms. We've recently introduced the "-run-with" option for exactly
this purpose, which is meant to handle the options that affect the
runtime behavior. Thus let's introduce a "user=..." parameter here now
and deprecate the old "-runas" option.
No need to deprecate it, there are other shortcut options that are
just a couple lines of code to implement:
case QEMU_OPTION_watchdog_action: {
opts = qemu_opts_create(qemu_find_opts("action"),
NULL, 0, &error_abort);
qemu_opt_set(opts, "watchdog", optarg, &error_abort);
break;
However that would be a larger patch, basically moving all of the
--run-with handling to qemu_process_early_options() (and, as an aside,
setting .merge_lists = true in qemu_run_with_opts).
No objections to your patch, but also no objections to cleaning all of
--run-with; I should have caught it and proposed the shortcut options
when it was introduced or when --chroot was removed.
Paolo
if (!os_set_runas(optarg)) {
error_report("User \"%s\" doesn't exist"
" (and is not <uid>:<gid>)",
@@ -3612,6 +3617,16 @@ void qemu_init(int argc, char **argv)
if (str) {
os_set_chroot(str);
}
+ str = qemu_opt_get(opts, "user");
+ if (str) {
+ if (!os_set_runas(str)) {
+ error_report("User \"%s\" doesn't
exist"
+ " (and is not <uid>:<gid>)",
+ optarg);
+ exit(1);
+ }
+ }
+
break;
}
#endif /* CONFIG_POSIX */
diff --git a/qemu-options.hx b/qemu-options.hx
index cf61f6b863..3031479a15 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -4824,7 +4824,8 @@ DEF("runas", HAS_ARG, QEMU_OPTION_runas, \
SRST
``-runas user``
Immediately before starting guest execution, drop root privileges,
- switching to the specified user.
+ switching to the specified user. This option is deprecated, use
+ ``-run-with user=...`` instead.
ERST
DEF("prom-env", HAS_ARG, QEMU_OPTION_prom_env,
@@ -4990,13 +4991,15 @@ DEF("qtest-log", HAS_ARG, QEMU_OPTION_qtest_log,
"", QEMU_ARCH_ALL)
#ifdef CONFIG_POSIX
DEF("run-with", HAS_ARG, QEMU_OPTION_run_with,
- "-run-with [async-teardown=on|off][,chroot=dir]\n"
+ "-run-with [async-teardown=on|off][,chroot=dir][user=username|uid:gid]\n"
" Set miscellaneous QEMU process lifecycle options:\n"
" async-teardown=on enables asynchronous teardown (Linux
only)\n"
- " chroot=dir chroot to dir just before starting the VM\n",
+ " chroot=dir chroot to dir just before starting the VM\n"
+ " user=username switch to the specified user before starting the
VM\n"
+ " user=uid:gid dito, but use specified user-ID and group-ID
instead\n",
QEMU_ARCH_ALL)
SRST
-``-run-with [async-teardown=on|off][,chroot=dir]``
+``-run-with [async-teardown=on|off][,chroot=dir][user=username|uid:gid]``
Set QEMU process lifecycle options.
``async-teardown=on`` enables asynchronous teardown. A new process called
@@ -5013,6 +5016,10 @@ SRST
``chroot=dir`` can be used for doing a chroot to the specified directory
immediately before starting the guest execution. This is especially useful
in combination with -runas.
+
+ ``user=username`` or ``user=uid:gid`` can be used to drop root privileges
+ by switching to the specified user (via username) or user and group
+ (via uid:gid) immediately before starting guest execution.
ERST
#endif
--
2.45.0
M