From patchwork Thu Oct 6 15:38:27 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Richa Marwaha X-Patchwork-Id: 118110 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from lists.gnu.org (lists.gnu.org [140.186.70.17]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (Client did not present a certificate) by ozlabs.org (Postfix) with ESMTPS id D4AA4B7091 for ; Fri, 7 Oct 2011 02:39:43 +1100 (EST) Received: from localhost ([::1]:47468 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1RBq2k-0003xB-5Y for incoming@patchwork.ozlabs.org; Thu, 06 Oct 2011 11:39:30 -0400 Received: from eggs.gnu.org ([140.186.70.92]:37359) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1RBq2e-0003uM-0V for qemu-devel@nongnu.org; Thu, 06 Oct 2011 11:39:25 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1RBq2X-0004pG-3g for qemu-devel@nongnu.org; Thu, 06 Oct 2011 11:39:23 -0400 Received: from e9.ny.us.ibm.com ([32.97.182.139]:35840) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1RBq2W-0004h6-VX for qemu-devel@nongnu.org; Thu, 06 Oct 2011 11:39:17 -0400 Received: from d01relay01.pok.ibm.com (d01relay01.pok.ibm.com [9.56.227.233]) by e9.ny.us.ibm.com (8.14.4/8.13.1) with ESMTP id p96F35L7022151 for ; Thu, 6 Oct 2011 11:03:05 -0400 Received: from d01av03.pok.ibm.com (d01av03.pok.ibm.com [9.56.224.217]) by d01relay01.pok.ibm.com (8.13.8/8.13.8/NCO v10.0) with ESMTP id p96Fcrdc174658 for ; Thu, 6 Oct 2011 11:38:53 -0400 Received: from d01av03.pok.ibm.com (loopback [127.0.0.1]) by d01av03.pok.ibm.com (8.14.4/8.13.1/NCO v10.0 AVout) with ESMTP id p96FcnNB023220 for ; Thu, 6 Oct 2011 12:38:49 -0300 Received: from localhost (richa-laptop-009056115168.pok.ibm.com [9.56.115.168]) by d01av03.pok.ibm.com (8.14.4/8.13.1/NCO v10.0 AVin) with ESMTP id p96FcmjG023146; Thu, 6 Oct 2011 12:38:48 -0300 From: Richa Marwaha To: qemu-devel@nongnu.org Date: Thu, 6 Oct 2011 11:38:27 -0400 Message-Id: <1317915508-15491-4-git-send-email-rmarwah@linux.vnet.ibm.com> X-Mailer: git-send-email 1.7.0.4 In-Reply-To: <1317915508-15491-1-git-send-email-rmarwah@linux.vnet.ibm.com> References: <1317915508-15491-1-git-send-email-rmarwah@linux.vnet.ibm.com> X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.6, seldom 2.4 (older, 4) X-Received-From: 32.97.182.139 Cc: aliguori@us.ibm.com, coreyb@linux.vnet.ibm.com, Richa Marwaha Subject: [Qemu-devel] [PATCH 3/4] Add cap reduction support to enable use as SUID X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org The ideal way to use qemu-bridge-helper is to give it an fscap of using: setcap cap_net_admin=ep qemu-bridge-helper Unfortunately, most distros still do not have a mechanism to package files with fscaps applied. This means they'll have to SUID the qemu-bridge-helper binary. To improve security, use libcap to reduce our capability set to just cap_net_admin, then reduce privileges down to the calling user. This is hopefully close to equivalent to fscap support from a security perspective. Signed-off-by: Richa Marwaha --- configure | 34 ++++++++++++++++++++++++++++++ qemu-bridge-helper.c | 56 ++++++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 90 insertions(+), 0 deletions(-) diff --git a/configure b/configure index 3e32834..f46e9b7 100755 --- a/configure +++ b/configure @@ -128,6 +128,7 @@ vnc_thread="no" xen="" xen_ctrl_version="" linux_aio="" +cap="" attr="" xfs="" @@ -653,6 +654,10 @@ for opt do ;; --enable-kvm) kvm="yes" ;; + --disable-cap) cap="no" + ;; + --enable-cap) cap="yes" + ;; --disable-spice) spice="no" ;; --enable-spice) spice="yes" @@ -1032,6 +1037,8 @@ echo " --disable-vde disable support for vde network" echo " --enable-vde enable support for vde network" echo " --disable-linux-aio disable Linux AIO support" echo " --enable-linux-aio enable Linux AIO support" +echo " --disable-cap disable libcap support" +echo " --enable-cap enable libcap support" echo " --disable-attr disables attr and xattr support" echo " --enable-attr enable attr and xattr support" echo " --disable-blobs disable installing provided firmware blobs" @@ -1638,6 +1645,29 @@ EOF fi ########################################## +# cap library probe +if test "$cap" != "no" ; then + cap_libs="-lcap" + cat > $TMPC << EOF +#include +int main(void) +{ + cap_init(); + return 0; +} +EOF + if compile_prog "" "$cap_libs" ; then + cap=yes + libs_tools="$cap_libs $libs_tools" + else + if test "$cap" = "yes" ; then + feature_not_found "cap" + fi + cap=no + fi +fi + +########################################## # Sound support libraries probe audio_drv_probe() @@ -2710,6 +2740,7 @@ echo "fdatasync $fdatasync" echo "madvise $madvise" echo "posix_madvise $posix_madvise" echo "uuid support $uuid" +echo "libcap support $cap" echo "vhost-net support $vhost_net" echo "Trace backend $trace_backend" echo "Trace output file $trace_file-" @@ -2821,6 +2852,9 @@ fi if test "$vde" = "yes" ; then echo "CONFIG_VDE=y" >> $config_host_mak fi +if test "$cap" = "yes" ; then + echo "CONFIG_LIBCAP=y" >> $config_host_mak +fi for card in $audio_card_list; do def=CONFIG_`echo $card | tr '[:lower:]' '[:upper:]'` echo "$def=y" >> $config_host_mak diff --git a/qemu-bridge-helper.c b/qemu-bridge-helper.c index 5e09fea..b1519e0 100644 --- a/qemu-bridge-helper.c +++ b/qemu-bridge-helper.c @@ -33,6 +33,10 @@ #include "net/tap-linux.h" +#ifdef CONFIG_LIBCAP +#include +#endif + #define MAX_ACLS (128) #define DEFAULT_ACL_FILE CONFIG_QEMU_CONFDIR "/bridge.conf" @@ -185,6 +189,47 @@ static int send_fd(int c, int fd) return sendmsg(c, &msg, 0); } +#ifdef CONFIG_LIBCAP +static int drop_privileges(void) +{ + cap_t cap; + cap_value_t new_caps[] = {CAP_NET_ADMIN}; + + cap = cap_init(); + + /* set capabilities to be permitted and inheritable. we don't need the + * caps to be effective right now as they'll get reset when we seteuid + * anyway */ + cap_set_flag(cap, CAP_PERMITTED, 1, new_caps, CAP_SET); + cap_set_flag(cap, CAP_INHERITABLE, 1, new_caps, CAP_SET); + + if (cap_set_proc(cap) == -1) { + return -1; + } + + cap_free(cap); + + /* reduce our privileges to a normal user */ + setegid(getgid()); + seteuid(getuid()); + + cap = cap_init(); + + /* enable the our capabilities. we marked them as inheritable earlier + * which is what allows this to work. */ + cap_set_flag(cap, CAP_EFFECTIVE, 1, new_caps, CAP_SET); + cap_set_flag(cap, CAP_PERMITTED, 1, new_caps, CAP_SET); + + if (cap_set_proc(cap) == -1) { + return -1; + } + + cap_free(cap); + + return 0; +} +#endif + int main(int argc, char **argv) { struct ifreq ifr; @@ -198,6 +243,17 @@ int main(int argc, char **argv) int acl_count = 0; int i, access_allowed, access_denied; +#ifdef CONFIG_LIBCAP + /* if we're run from an suid binary, immediately drop privileges preserving + * cap_net_admin */ + if (geteuid() == 0 && getuid() != geteuid()) { + if (drop_privileges() == -1) { + fprintf(stderr, "failed to drop privileges\n"); + return 1; + } + } +#endif + /* parse arguments */ if (argc < 3 || argc > 4) { fprintf(stderr, "Usage: %s [--use-vnet] BRIDGE FD\n", argv[0]);