| Message ID | 20240506112058.51446-1-thuth@redhat.com |
|---|---|
| State | New |
| Headers | show |
| Series | [v2] qemu-options: Deprecate "-runas" and introduce "-run-with user=..." instead | expand |
On 6/5/24 13:20, Thomas Huth wrote: > The old "-runas" option has the disadvantage that it is not visible > in the QAPI schema, so it is not available via the normal introspection > mechanisms. We've recently introduced the "-run-with" option for exactly > this purpose, which is meant to handle the options that affect the > runtime behavior. Thus let's introduce a "user=..." parameter here now > and deprecate the old "-runas" option. > > Signed-off-by: Thomas Huth <thuth@redhat.com> > --- > v2: Add missing part in qemu-options.hx as suggested by Philippe > > docs/about/deprecated.rst | 6 ++++++ > system/vl.c | 15 +++++++++++++++ > qemu-options.hx | 15 +++++++++++---- > 3 files changed, 32 insertions(+), 4 deletions(-) Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
On Mon, May 6, 2024 at 1:21 PM Thomas Huth <thuth@redhat.com> wrote: > > The old "-runas" option has the disadvantage that it is not visible > in the QAPI schema, so it is not available via the normal introspection > mechanisms. We've recently introduced the "-run-with" option for exactly > this purpose, which is meant to handle the options that affect the > runtime behavior. Thus let's introduce a "user=..." parameter here now > and deprecate the old "-runas" option. No need to deprecate it, there are other shortcut options that are just a couple lines of code to implement: case QEMU_OPTION_watchdog_action: { opts = qemu_opts_create(qemu_find_opts("action"), NULL, 0, &error_abort); qemu_opt_set(opts, "watchdog", optarg, &error_abort); break; However that would be a larger patch, basically moving all of the --run-with handling to qemu_process_early_options() (and, as an aside, setting .merge_lists = true in qemu_run_with_opts). No objections to your patch, but also no objections to cleaning all of --run-with; I should have caught it and proposed the shortcut options when it was introduced or when --chroot was removed. Paolo > if (!os_set_runas(optarg)) { > error_report("User \"%s\" doesn't exist" > " (and is not <uid>:<gid>)", > @@ -3612,6 +3617,16 @@ void qemu_init(int argc, char **argv) > if (str) { > os_set_chroot(str); > } > + str = qemu_opt_get(opts, "user"); > + if (str) { > + if (!os_set_runas(str)) { > + error_report("User \"%s\" doesn't exist" > + " (and is not <uid>:<gid>)", > + optarg); > + exit(1); > + } > + } > + > break; > } > #endif /* CONFIG_POSIX */ > diff --git a/qemu-options.hx b/qemu-options.hx > index cf61f6b863..3031479a15 100644 > --- a/qemu-options.hx > +++ b/qemu-options.hx > @@ -4824,7 +4824,8 @@ DEF("runas", HAS_ARG, QEMU_OPTION_runas, \ > SRST > ``-runas user`` > Immediately before starting guest execution, drop root privileges, > - switching to the specified user. > + switching to the specified user. This option is deprecated, use > + ``-run-with user=...`` instead. > ERST > > DEF("prom-env", HAS_ARG, QEMU_OPTION_prom_env, > @@ -4990,13 +4991,15 @@ DEF("qtest-log", HAS_ARG, QEMU_OPTION_qtest_log, "", QEMU_ARCH_ALL) > > #ifdef CONFIG_POSIX > DEF("run-with", HAS_ARG, QEMU_OPTION_run_with, > - "-run-with [async-teardown=on|off][,chroot=dir]\n" > + "-run-with [async-teardown=on|off][,chroot=dir][user=username|uid:gid]\n" > " Set miscellaneous QEMU process lifecycle options:\n" > " async-teardown=on enables asynchronous teardown (Linux only)\n" > - " chroot=dir chroot to dir just before starting the VM\n", > + " chroot=dir chroot to dir just before starting the VM\n" > + " user=username switch to the specified user before starting the VM\n" > + " user=uid:gid dito, but use specified user-ID and group-ID instead\n", > QEMU_ARCH_ALL) > SRST > -``-run-with [async-teardown=on|off][,chroot=dir]`` > +``-run-with [async-teardown=on|off][,chroot=dir][user=username|uid:gid]`` > Set QEMU process lifecycle options. > > ``async-teardown=on`` enables asynchronous teardown. A new process called > @@ -5013,6 +5016,10 @@ SRST > ``chroot=dir`` can be used for doing a chroot to the specified directory > immediately before starting the guest execution. This is especially useful > in combination with -runas. > + > + ``user=username`` or ``user=uid:gid`` can be used to drop root privileges > + by switching to the specified user (via username) or user and group > + (via uid:gid) immediately before starting guest execution. > ERST > #endif > > -- > 2.45.0 >M
On 5/6/24 13:20, Thomas Huth wrote: > The old "-runas" option has the disadvantage that it is not visible > in the QAPI schema, so it is not available via the normal introspection > mechanisms. We've recently introduced the "-run-with" option for exactly > this purpose, which is meant to handle the options that affect the > runtime behavior. Thus let's introduce a "user=..." parameter here now > and deprecate the old "-runas" option. > > Signed-off-by: Thomas Huth <thuth@redhat.com> > --- > v2: Add missing part in qemu-options.hx as suggested by Philippe > > docs/about/deprecated.rst | 6 ++++++ > system/vl.c | 15 +++++++++++++++ > qemu-options.hx | 15 +++++++++++---- > 3 files changed, 32 insertions(+), 4 deletions(-) > > diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst > index 3310df3274..fe69e2d44c 100644 > --- a/docs/about/deprecated.rst > +++ b/docs/about/deprecated.rst > @@ -61,6 +61,12 @@ configurations (e.g. -smp drawers=1,books=1,clusters=1 for x86 PC machine) is > marked deprecated since 9.0, users have to ensure that all the topology members > described with -smp are supported by the target machine. > > +``-runas`` (since 9.1) > +---------------------- > + > +Use ``-run-with user=..`` instead. > + > + > User-mode emulator command line arguments > ----------------------------------------- > > diff --git a/system/vl.c b/system/vl.c > index 7756eac81e..b031427440 100644 > --- a/system/vl.c > +++ b/system/vl.c > @@ -773,6 +773,10 @@ static QemuOptsList qemu_run_with_opts = { > .name = "chroot", > .type = QEMU_OPT_STRING, > }, > + { > + .name = "user", > + .type = QEMU_OPT_STRING, > + }, > { /* end of list */ } > }, > }; > @@ -3586,6 +3590,7 @@ void qemu_init(int argc, char **argv) > break; > #if defined(CONFIG_POSIX) > case QEMU_OPTION_runas: > + warn_report("-runas is deprecated, use '-run-with user=...' instead"); > if (!os_set_runas(optarg)) { > error_report("User \"%s\" doesn't exist" > " (and is not <uid>:<gid>)", > @@ -3612,6 +3617,16 @@ void qemu_init(int argc, char **argv) > if (str) { > os_set_chroot(str); > } > + str = qemu_opt_get(opts, "user"); > + if (str) { > + if (!os_set_runas(str)) { > + error_report("User \"%s\" doesn't exist" > + " (and is not <uid>:<gid>)", > + optarg); > + exit(1); > + } > + } > + > break; > } > #endif /* CONFIG_POSIX */ > diff --git a/qemu-options.hx b/qemu-options.hx > index cf61f6b863..3031479a15 100644 > --- a/qemu-options.hx > +++ b/qemu-options.hx > @@ -4824,7 +4824,8 @@ DEF("runas", HAS_ARG, QEMU_OPTION_runas, \ > SRST > ``-runas user`` > Immediately before starting guest execution, drop root privileges, > - switching to the specified user. > + switching to the specified user. This option is deprecated, use > + ``-run-with user=...`` instead. > ERST > > DEF("prom-env", HAS_ARG, QEMU_OPTION_prom_env, > @@ -4990,13 +4991,15 @@ DEF("qtest-log", HAS_ARG, QEMU_OPTION_qtest_log, "", QEMU_ARCH_ALL) > > #ifdef CONFIG_POSIX > DEF("run-with", HAS_ARG, QEMU_OPTION_run_with, > - "-run-with [async-teardown=on|off][,chroot=dir]\n" > + "-run-with [async-teardown=on|off][,chroot=dir][user=username|uid:gid]\n" > " Set miscellaneous QEMU process lifecycle options:\n" > " async-teardown=on enables asynchronous teardown (Linux only)\n" > - " chroot=dir chroot to dir just before starting the VM\n", > + " chroot=dir chroot to dir just before starting the VM\n" > + " user=username switch to the specified user before starting the VM\n" > + " user=uid:gid dito, but use specified user-ID and group-ID instead\n", nit: ditto? Ciao, C > QEMU_ARCH_ALL) > SRST > -``-run-with [async-teardown=on|off][,chroot=dir]`` > +``-run-with [async-teardown=on|off][,chroot=dir][user=username|uid:gid]`` > Set QEMU process lifecycle options. > > ``async-teardown=on`` enables asynchronous teardown. A new process called > @@ -5013,6 +5016,10 @@ SRST > ``chroot=dir`` can be used for doing a chroot to the specified directory > immediately before starting the guest execution. This is especially useful > in combination with -runas. > + > + ``user=username`` or ``user=uid:gid`` can be used to drop root privileges > + by switching to the specified user (via username) or user and group > + (via uid:gid) immediately before starting guest execution. > ERST > #endif >
On 08/05/2024 15.20, Claudio Fontana wrote: > On 5/6/24 13:20, Thomas Huth wrote: >> The old "-runas" option has the disadvantage that it is not visible >> in the QAPI schema, so it is not available via the normal introspection >> mechanisms. We've recently introduced the "-run-with" option for exactly >> this purpose, which is meant to handle the options that affect the >> runtime behavior. Thus let's introduce a "user=..." parameter here now >> and deprecate the old "-runas" option. >> >> Signed-off-by: Thomas Huth <thuth@redhat.com> >> --- >> v2: Add missing part in qemu-options.hx as suggested by Philippe >> >> docs/about/deprecated.rst | 6 ++++++ >> system/vl.c | 15 +++++++++++++++ >> qemu-options.hx | 15 +++++++++++---- >> 3 files changed, 32 insertions(+), 4 deletions(-) >> >> diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst >> index 3310df3274..fe69e2d44c 100644 >> --- a/docs/about/deprecated.rst >> +++ b/docs/about/deprecated.rst >> @@ -61,6 +61,12 @@ configurations (e.g. -smp drawers=1,books=1,clusters=1 for x86 PC machine) is >> marked deprecated since 9.0, users have to ensure that all the topology members >> described with -smp are supported by the target machine. >> >> +``-runas`` (since 9.1) >> +---------------------- >> + >> +Use ``-run-with user=..`` instead. >> + >> + >> User-mode emulator command line arguments >> ----------------------------------------- >> >> diff --git a/system/vl.c b/system/vl.c >> index 7756eac81e..b031427440 100644 >> --- a/system/vl.c >> +++ b/system/vl.c >> @@ -773,6 +773,10 @@ static QemuOptsList qemu_run_with_opts = { >> .name = "chroot", >> .type = QEMU_OPT_STRING, >> }, >> + { >> + .name = "user", >> + .type = QEMU_OPT_STRING, >> + }, >> { /* end of list */ } >> }, >> }; >> @@ -3586,6 +3590,7 @@ void qemu_init(int argc, char **argv) >> break; >> #if defined(CONFIG_POSIX) >> case QEMU_OPTION_runas: >> + warn_report("-runas is deprecated, use '-run-with user=...' instead"); >> if (!os_set_runas(optarg)) { >> error_report("User \"%s\" doesn't exist" >> " (and is not <uid>:<gid>)", >> @@ -3612,6 +3617,16 @@ void qemu_init(int argc, char **argv) >> if (str) { >> os_set_chroot(str); >> } >> + str = qemu_opt_get(opts, "user"); >> + if (str) { >> + if (!os_set_runas(str)) { >> + error_report("User \"%s\" doesn't exist" >> + " (and is not <uid>:<gid>)", >> + optarg); >> + exit(1); >> + } >> + } >> + >> break; >> } >> #endif /* CONFIG_POSIX */ >> diff --git a/qemu-options.hx b/qemu-options.hx >> index cf61f6b863..3031479a15 100644 >> --- a/qemu-options.hx >> +++ b/qemu-options.hx >> @@ -4824,7 +4824,8 @@ DEF("runas", HAS_ARG, QEMU_OPTION_runas, \ >> SRST >> ``-runas user`` >> Immediately before starting guest execution, drop root privileges, >> - switching to the specified user. >> + switching to the specified user. This option is deprecated, use >> + ``-run-with user=...`` instead. >> ERST >> >> DEF("prom-env", HAS_ARG, QEMU_OPTION_prom_env, >> @@ -4990,13 +4991,15 @@ DEF("qtest-log", HAS_ARG, QEMU_OPTION_qtest_log, "", QEMU_ARCH_ALL) >> >> #ifdef CONFIG_POSIX >> DEF("run-with", HAS_ARG, QEMU_OPTION_run_with, >> - "-run-with [async-teardown=on|off][,chroot=dir]\n" >> + "-run-with [async-teardown=on|off][,chroot=dir][user=username|uid:gid]\n" >> " Set miscellaneous QEMU process lifecycle options:\n" >> " async-teardown=on enables asynchronous teardown (Linux only)\n" >> - " chroot=dir chroot to dir just before starting the VM\n", >> + " chroot=dir chroot to dir just before starting the VM\n" >> + " user=username switch to the specified user before starting the VM\n" >> + " user=uid:gid dito, but use specified user-ID and group-ID instead\n", > > nit: ditto? Thanks, I'll fix it! Thomas
diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst index 3310df3274..fe69e2d44c 100644 --- a/docs/about/deprecated.rst +++ b/docs/about/deprecated.rst @@ -61,6 +61,12 @@ configurations (e.g. -smp drawers=1,books=1,clusters=1 for x86 PC machine) is marked deprecated since 9.0, users have to ensure that all the topology members described with -smp are supported by the target machine. +``-runas`` (since 9.1) +---------------------- + +Use ``-run-with user=..`` instead. + + User-mode emulator command line arguments ----------------------------------------- diff --git a/system/vl.c b/system/vl.c index 7756eac81e..b031427440 100644 --- a/system/vl.c +++ b/system/vl.c @@ -773,6 +773,10 @@ static QemuOptsList qemu_run_with_opts = { .name = "chroot", .type = QEMU_OPT_STRING, }, + { + .name = "user", + .type = QEMU_OPT_STRING, + }, { /* end of list */ } }, }; @@ -3586,6 +3590,7 @@ void qemu_init(int argc, char **argv) break; #if defined(CONFIG_POSIX) case QEMU_OPTION_runas: + warn_report("-runas is deprecated, use '-run-with user=...' instead"); if (!os_set_runas(optarg)) { error_report("User \"%s\" doesn't exist" " (and is not <uid>:<gid>)", @@ -3612,6 +3617,16 @@ void qemu_init(int argc, char **argv) if (str) { os_set_chroot(str); } + str = qemu_opt_get(opts, "user"); + if (str) { + if (!os_set_runas(str)) { + error_report("User \"%s\" doesn't exist" + " (and is not <uid>:<gid>)", + optarg); + exit(1); + } + } + break; } #endif /* CONFIG_POSIX */ diff --git a/qemu-options.hx b/qemu-options.hx index cf61f6b863..3031479a15 100644 --- a/qemu-options.hx +++ b/qemu-options.hx @@ -4824,7 +4824,8 @@ DEF("runas", HAS_ARG, QEMU_OPTION_runas, \ SRST ``-runas user`` Immediately before starting guest execution, drop root privileges, - switching to the specified user. + switching to the specified user. This option is deprecated, use + ``-run-with user=...`` instead. ERST DEF("prom-env", HAS_ARG, QEMU_OPTION_prom_env, @@ -4990,13 +4991,15 @@ DEF("qtest-log", HAS_ARG, QEMU_OPTION_qtest_log, "", QEMU_ARCH_ALL) #ifdef CONFIG_POSIX DEF("run-with", HAS_ARG, QEMU_OPTION_run_with, - "-run-with [async-teardown=on|off][,chroot=dir]\n" + "-run-with [async-teardown=on|off][,chroot=dir][user=username|uid:gid]\n" " Set miscellaneous QEMU process lifecycle options:\n" " async-teardown=on enables asynchronous teardown (Linux only)\n" - " chroot=dir chroot to dir just before starting the VM\n", + " chroot=dir chroot to dir just before starting the VM\n" + " user=username switch to the specified user before starting the VM\n" + " user=uid:gid dito, but use specified user-ID and group-ID instead\n", QEMU_ARCH_ALL) SRST -``-run-with [async-teardown=on|off][,chroot=dir]`` +``-run-with [async-teardown=on|off][,chroot=dir][user=username|uid:gid]`` Set QEMU process lifecycle options. ``async-teardown=on`` enables asynchronous teardown. A new process called @@ -5013,6 +5016,10 @@ SRST ``chroot=dir`` can be used for doing a chroot to the specified directory immediately before starting the guest execution. This is especially useful in combination with -runas. + + ``user=username`` or ``user=uid:gid`` can be used to drop root privileges + by switching to the specified user (via username) or user and group + (via uid:gid) immediately before starting guest execution. ERST #endif
The old "-runas" option has the disadvantage that it is not visible in the QAPI schema, so it is not available via the normal introspection mechanisms. We've recently introduced the "-run-with" option for exactly this purpose, which is meant to handle the options that affect the runtime behavior. Thus let's introduce a "user=..." parameter here now and deprecate the old "-runas" option. Signed-off-by: Thomas Huth <thuth@redhat.com> --- v2: Add missing part in qemu-options.hx as suggested by Philippe docs/about/deprecated.rst | 6 ++++++ system/vl.c | 15 +++++++++++++++ qemu-options.hx | 15 +++++++++++---- 3 files changed, 32 insertions(+), 4 deletions(-)