Re: [libvirt] [PATCH] virt-login-shell joins users into lxc container.

On 07/20/2013 05:46 AM, dwalsh(a)redhat.com wrote: I'm afraid this needs another version, and thus I'm reluctant to take it into 1.1.1 if we can't get it fixed quickly. This probably needs to be %{mingw64_sysconfdir}. For that matter, does virt-login-shell even make sense on mingw, or is it a Linux-only concept where the mingw .spec file should be ensuring that it is not compiled nor installed? In other words, is virt-login-shell.exe even capable of doing anything useful on mingw? This looks like an independently useful function; it would be worth splitting this patch into a series where patch 1 adds the new function, and patch 2 takes advantage of it, rather than mixing it all into one patch. Is it worth rewriting the existing: char *virGetUserDirectory(void) { return virGetUserDirectoryByUID(geteuid()); } Doing so would give us instant code coverage of the new function. Since the .spec file is installing this file as setuid, shouldn't 'make install' attempt to do so likewise (that is, do more than just the normal reliance on automake's bin_PROGRAMS, which doesn't set special mode bits)? Or is setuid something rare enough that only spec files need to be requesting it? I'm thinking about the case of someone that does './configure --prefix=$HOME' with the intent of installing local tools - will virt-login-shell be usable by such a user? We tend to list system headers before "" headers; but it shouldn't be a problem that you did it the other way around. static variables are already 0-initialized without needing an explicit initializer; while gcc is smart enough to optimize explicit zero optimization into using the bss, not all compilers are that good. unnecessary doubled space Style nit: we prefer: static void virLoginShellFini(virConnectPtr conn, virDomainPtr dom) { Style nit: we prefer blank line between local variable declarations and expressions. Style nit: we prefer spaces around '='. This looks like leak prevention (good so that tools like valgrind don't complain)... ...whereas this may be dead code - if we are not supposed to use anything after virLoginShellFini() has been called (because we are about to exit or exec), then cleaning things back to a zero-initialized state is wasted cycles. On the other hand, being defensive against reuse can't hurt, and as this will be setuid, paranoia is okay. Do you modify 'name'? If not, add 'const'. Style nit: static int virLoginShellAllowedUser(virConfPtr conf, uid_t uid, gid_t gid, const char *name) { > + virConfValuePtr p; > + int ret = -1; > + char *ptr = NULL; > + gid_t *groups = NULL; > + char *gname = NULL; > + > + p = virConfGetValue(conf, "allowed_users"); > + if (!p) { > + errno = EPERM; > + fprintf(stderr, _("%s is not allowed to connect a container: %m\n"), name); %m is not POSIX; it is not safe to use here. Also, why do you need to use fprintf instead of more typical virReportSystemError(), which already provides strerror() as part of the logged message? Style nit: space around '=' So if the user passes "%" as one of their strings in the list, we just ignore it - but only after checking it against fnmatch? I'm not following why % is allowed, or what it does. [\me reads the .conf file] Oh, %engineers is a way to match all users within the 'engineers' group. But if there is a %, then I think you DON'T want to fnmatch() right away. %m is unacceptable. virGetGroupList() already reported its own error message with virReportError, so why are you duplicating the error message here with fprintf? Shouldn't we instead be setting up error logging to use virError set to stderr, to take advantage of all the helper routines we call that already log their own errors? space around '=' 'gname=NULL;' is spurious; VIR_FREE(gname) already sets gname to NULL. Memory leak. You have an outer loop that can potentially iterate over multiple user tokens, and a call to virGetGroupList that allocates groups once per user token starting with %, but nothing that frees groups between iterations. You set errno... ...then promptly nuke it with an fprintf(). If you want errno to be in a known state after this function returns failure, then you must set it after anything else that might alter errno. static char ** virLoginShellGetShellArgv(virConfPtr conf) { > + char **shargv; > + virConfValuePtr p; > + p = virConfGetValue(conf, "shell"); > + if (!p) > + return virStringSplit("/bin/sh --login", " ", 3); Use the POSIX spelling s/--login/-l/. After all, on debian, people install dash as /bin/sh, but dash doesn't like long options. Just because /bin/sh is bash on Fedora doesn't mean it is safe to abuse that fact. I'm wondering if we should have a helper function that makes it easier to parse a list of strings out of a conf file, instead of having to open-code our own iterator (this is the second time you've done a string-list iteration in this patch alone). main(int argc, char **argv) { Maybe I'm asking a stupid question, but why getuid() instead of geteuid()? Ditto for getegid(). %m is bad. By placing this here, we give this failure message even for innocent usage like 'virt-login-shell --help' done as root. Would it make more sense to defer user enforcement until after option parsing, so that even root can at least probe the version of this software instead of being blindly rejected? %m is bad. Evil. All good programs should support --help and --program at a minimum - especially setuid programs in order to explain why they are setuid. %m - and back to my question about why you aren't initializing the existing virError framework to use that to print to stderr instead of repeating it yourself. Remember, virGetUserName() does NOT guarantee a sane errno value on failure. > + homedir = virGetUserDirectoryByUID(uid); > + if (!homedir) { > + fprintf(stderr, _("Can't read %s home directory: %m\n"), name); %m, and virGetUserDirectoryByUID() does NOT guarantee a sane errno value on failure. > + > + if (!(conf = virConfReadFile(login_shell_path, 0))) { > + fprintf(stderr, _("Failed to read %s: %m\n"), login_shell_path); %m > + if (virLoginShellAllowedUser(conf, uid, gid, name) < 0) > + goto cleanup; > + > + if (!(shargv = virLoginShellGetShellArgv(conf))) > + goto cleanup; > + > + conn = virConnectOpen("lxc:///"); This hard-codes us to LXC. We should allow a -c option, similar to other tools in the virt-stack, to let the user specify an alternate connection name. virConnectOpen(NULL) seems more future-proof, in case we ever change our default container hypervisor away from lxc:/// over to some other URI. %m > + > + dom = virDomainLookupByName(conn, name); > + if (!dom) { > + fprintf(stderr, _("Container %s does not exist: %m\n"), name); %m > + > + if (! virDomainIsActive(dom) && virDomainCreate(dom)) { Style nit: no space after '!' Long line; wrap to stay within 80 columns. Ah, we ARE hard-coding ourselves to lxc, by relying on an API that can only be successful when talking to lxc. %m > + > + if (VIR_ALLOC(secmodel) < 0) > + goto cleanup; > + if (VIR_ALLOC(seclabel) < 0) > + goto cleanup; > + if (virNodeGetSecurityModel(conn, secmodel) < 0) > + goto cleanup; > + if (virDomainGetSecurityLabel(dom, seclabel) < 0) > + goto cleanup; > + > + if (virFork(&cpid) < 0) > + goto cleanup; > + > + if (cpid == 0) { > + gid_t *groups = NULL; > + int ngroups; > + pid_t ccpid; > + > + /* Fork once because we don't want to affect > + * virt-login-shell's namespace itself > + */ > + if (virSetUIDGID(0, 0, 0, 0) < 0) { virSetUIDGID(0, 0, NULL, 0) - I don't like the use of '0' when NULL is intended. %m - and you are neither guaranteed that errno is reliable on failure, nor that the failure of virSetUIDGID was caused by setresuid. What, no error message on why you exited? Again, I think you need to wire up virError handling to report to stderr by default. Since you aren't setting caps, why not use the simpler virSetUIDGID()? %m %m Generally, you want to exit with status 126 or 127 after execv() failure, not 1; although I'm not sure it matters much here. s/containe/container/ s/--login/-l/ s/--login/-l/ s/syntaxt/syntax/ Umm, but you just coded it so that the executable always fails when run as root. s/exists. And they are/exists, and as/ Long line; wrap to keep in 80 columns. -- Eric Blake eblake redhat com +1-919-301-3266 Libvirt virtualization library http://libvirt.org