12:01 p.m.
Changes from [v2]:
* add explicit fallback to root:root for unrecognized operating
systems;
* provide logging to help users understand why they ended up with
root:root in the first place.
Changes from [v1]:
* use distro-specific user and group;
* warn the user if they are going to be running QEMU as root.
[v2] https://www.redhat.com/archives/libvir-list/2019-March/msg01737.html
[v1] https://www.redhat.com/archives/libvir-list/2019-March/msg01707.html
Andrea Bolognani (2):
m4: Run QEMU under a distro-specific user when possible
m4: Add warning when running QEMU as root
m4/virt-driver-qemu.m4 | 45 +++++++++++++++++++++++++++++++++++++++---
1 file changed, 42 insertions(+), 3 deletions(-)
--
2.20.1
12:01 p.m.
New subject: [libvirt] [PATCH v3 1/2] m4: Run QEMU under a distro-specific user when possible
Our current defaults are root:wheel on FreeBSD and macOS, root:root
everywhere else.
Looking at what downstream distributions actually do, we can see that
these defaults are overriden the vast majority of the time, with a
number of variations showing up in the wild:
* qemu:qemu -> Used by CentOS, Fedora, Gentoo, OpenSUSE, RHEL
and... As it turns out, our very own spec file :)
* libvirt-qemu:libvirt-qemu -> Used by Debian.
* libvirt-qemu:kvm -> Used by Ubuntu.
* nobody:nobody -> Used by Arch Linux.
Based on this information, we can do a better job at integrating with
downstream packages: if the distro-specific user and group already
exist on the system then we use them, and if not (or we're building
on an unknown OS) we just use root:root as we would have before.
This change makes it less likely that people building from source
will end up running their guests as root, which is a very desiderable
outcome from the security point of view.
Signed-off-by: Andrea Bolognani <abologna(a)redhat.com>
---
Proof that I'm not making any of this up:
* Alpine Linux
https://github.com/alpinelinux/aports/blob/master/main/libvirt/APKBUILD
* Arch Linux
https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=libvirt-git#n113
* CentOS
https://git.centos.org/blob/rpms!libvirt.git/8d86411e5109d791edf49c7f43c0...
* Debian
https://salsa.debian.org/libvirt-team/libvirt/blob/debian/sid/debian/rule...
* Fedora
https://src.fedoraproject.org/rpms/libvirt/blob/f29/f/libvirt.spec#_204
* FreeBSD
https://github.com/freebsd/freebsd-ports/blob/master/devel/libvirt/Makefile
* Gentoo
https://github.com/gentoo/gentoo/blob/master/app-emulation/libvirt/libvir...
* macOS (Homebrew)
https://github.com/Homebrew/homebrew-core/blob/master/Formula/libvirt.rb
* OpenSUSE
https://build.opensuse.org/package/view_file/openSUSE:Leap:15.0:Update/li...
* Ubuntu
https://git.launchpad.net/ubuntu/+source/libvirt/tree/debian/rules?h=ubun...
* Upstream :)
https://libvirt.org/git/?p=libvirt.git;a=blob;f=libvirt.spec.in;h=b7a35a0...
m4/virt-driver-qemu.m4 | 38 ++++++++++++++++++++++++++++++++++++--
1 file changed, 36 insertions(+), 2 deletions(-)
diff --git a/m4/virt-driver-qemu.m4 b/m4/virt-driver-qemu.m4
index cb05c34265..385d5307a9 100644
--- a/m4/virt-driver-qemu.m4
+++ b/m4/virt-driver-qemu.m4
@@ -44,8 +44,42 @@ AC_DEFUN([LIBVIRT_DRIVER_CHECK_QEMU], [
default_qemu_user=root
default_qemu_group=wheel
else
- default_qemu_user=root
- default_qemu_group=root
+ # Try to integrate gracefully with downstream packages by running QEMU
+ # processes under the same user and group they would
+ case $(grep ^ID= /etc/os-release 2>/dev/null) in
+ *arch*)
+ default_qemu_user=nobody
+ default_qemu_group=nobody
+ ;;
+ *centos*|*fedora*|*gentoo*|*rhel*|*suse*)
+ default_qemu_user=top
+ default_qemu_group=kek
+ ;;
+ *debian*)
+ default_qemu_user=libvirt-qemu
+ default_qemu_group=libvirt-qemu
+ ;;
+ *ubuntu*)
+ default_qemu_user=libvirt-qemu
+ default_qemu_group=kvm
+ ;;
+ *)
+ default_qemu_user=root
+ default_qemu_group=root
+ ;;
+ esac
+ # If the expected user and group don't exist, or we haven't hit any
+ # of the cases above because we're running on an unknown OS, the only
+ # sensible fallback is root:root
+ AC_MSG_CHECKING([for QEMU credentials ($default_qemu_user:$default_qemu_group)])
+ if getent passwd "$default_qemu_user" >/dev/null 2>&1 &&
\
+ getent group "$default_qemu_group" >/dev/null 2>&1; then
+ AC_MSG_RESULT([ok])
+ else
+ AC_MSG_RESULT([not found, using root:root instead])
+ default_qemu_user=root
+ default_qemu_group=root
+ fi
fi
if test "x$with_qemu_user" = "xplatform dependent" ; then
--
2.20.1
12:17 p.m.
New subject: [libvirt] [PATCH v3 1/2] m4: Run QEMU under a distro-specific user when possible
On Tue, Mar 26, 2019 at 06:01:48PM +0100, Andrea Bolognani wrote:
Our current defaults are root:wheel on FreeBSD and macOS, root:root
everywhere else.
Looking at what downstream distributions actually do, we can see that
these defaults are overriden the vast majority of the time, with a
number of variations showing up in the wild:
* qemu:qemu -> Used by CentOS, Fedora, Gentoo, OpenSUSE, RHEL
and... As it turns out, our very own spec file :)
* libvirt-qemu:libvirt-qemu -> Used by Debian.
* libvirt-qemu:kvm -> Used by Ubuntu.
* nobody:nobody -> Used by Arch Linux.
Based on this information, we can do a better job at integrating with
downstream packages: if the distro-specific user and group already
exist on the system then we use them, and if not (or we're building
on an unknown OS) we just use root:root as we would have before.
This change makes it less likely that people building from source
will end up running their guests as root, which is a very desiderable
outcome from the security point of view.
Signed-off-by: Andrea Bolognani <abologna(a)redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange(a)redhat.com>
Regards,
Daniel
--
|: https://berrange.com -o- https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org -o- https://fstop138.berrange.com :|
|: https://entangle-photo.org -o- https://www.instagram.com/dberrange :|
12:01 p.m.
New subject: [libvirt] [PATCH v3 2/2] m4: Add warning when running QEMU as root
Running QEMU as root is a pretty bad idea, so try to make the
user aware of that as part of the configure summary.
Signed-off-by: Andrea Bolognani <abologna(a)redhat.com>
---
m4/virt-driver-qemu.m4 | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/m4/virt-driver-qemu.m4 b/m4/virt-driver-qemu.m4
index 385d5307a9..eeb96f6ee5 100644
--- a/m4/virt-driver-qemu.m4
+++ b/m4/virt-driver-qemu.m4
@@ -112,5 +112,10 @@ AC_DEFUN([LIBVIRT_DRIVER_RESULT_QEMU], [
])
AC_DEFUN([LIBVIRT_RESULT_QEMU_PRIVILEGES], [
- LIBVIRT_RESULT([QEMU], [$QEMU_USER:$QEMU_GROUP])
+ if test "$QEMU_USER" = "root"; then
+ LIBVIRT_RESULT([QEMU], [$QEMU_USER:$QEMU_GROUP],
+ [!!! running QEMU as root is strongly discouraged !!!])
+ else
+ LIBVIRT_RESULT([QEMU], [$QEMU_USER:$QEMU_GROUP])
+ fi
])
--
2.20.1
12:17 p.m.
New subject: [libvirt] [PATCH v3 2/2] m4: Add warning when running QEMU as root
On Tue, Mar 26, 2019 at 06:01:49PM +0100, Andrea Bolognani wrote:
Running QEMU as root is a pretty bad idea, so try to make the
user aware of that as part of the configure summary.
Signed-off-by: Andrea Bolognani <abologna(a)redhat.com>
---
m4/virt-driver-qemu.m4 | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
Reviewed-by: Daniel P. Berrangé <berrange(a)redhat.com>
Regards,
Daniel
--
|: https://berrange.com -o- https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org -o- https://fstop138.berrange.com :|
|: https://entangle-photo.org -o- https://www.instagram.com/dberrange :|
2068
days inactive
2068
days old
4 comments
2 participants
participants (2)
-
Andrea Bolognani -
Daniel P. Berrangé