From: Corey Bryant <coreyb@linux.vnet.ibm.com>
To: qemu-devel@nongnu.org
Cc: aliguori@us.ibm.com, rmarwah@linux.vnet.ibm.com
Subject: [Qemu-devel] [PATCH v6 3/4] Add cap reduction support to enable use as SUID
Date: Mon, 19 Dec 2011 08:11:57 -0500 [thread overview]
Message-ID: <1324300318-3419-4-git-send-email-coreyb@linux.vnet.ibm.com> (raw)
In-Reply-To: <1324300318-3419-1-git-send-email-coreyb@linux.vnet.ibm.com>
The ideal way to use qemu-bridge-helper is to give it an fscap of using:
setcap cap_net_admin=ep qemu-bridge-helper
Unfortunately, most distros still do not have a mechanism to package files
with fscaps applied. This means they'll have to SUID the qemu-bridge-helper
binary.
To improve security, use libcap to reduce our capability set to just
cap_net_admin, then reduce privileges down to the calling user. This is
hopefully close to equivalent to fscap support from a security perspective.
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
Signed-off-by: Richa Marwaha <rmarwah@linux.vnet.ibm.com>
Signed-off-by: Corey Bryant <coreyb@linux.vnet.ibm.com>
---
configure | 34 ++++++++++++++++++++++++++++++++++
qemu-bridge-helper.c | 36 ++++++++++++++++++++++++++++++++++++
2 files changed, 70 insertions(+), 0 deletions(-)
diff --git a/configure b/configure
index 6c3a2f3..6ed4196 100755
--- a/configure
+++ b/configure
@@ -133,6 +133,7 @@ vnc_thread="no"
xen=""
xen_ctrl_version=""
linux_aio=""
+cap=""
attr=""
libattr=""
xfs=""
@@ -668,6 +669,10 @@ for opt do
;;
--enable-tcg-interpreter) tcg_interpreter="yes"
;;
+ --disable-cap) cap="no"
+ ;;
+ --enable-cap) cap="yes"
+ ;;
--disable-spice) spice="no"
;;
--enable-spice) spice="yes"
@@ -1051,6 +1056,8 @@ echo " --disable-vde disable support for vde network"
echo " --enable-vde enable support for vde network"
echo " --disable-linux-aio disable Linux AIO support"
echo " --enable-linux-aio enable Linux AIO support"
+echo " --disable-cap disable libcap-ng support"
+echo " --enable-cap enable libcap-ng support"
echo " --disable-attr disables attr and xattr support"
echo " --enable-attr enable attr and xattr support"
echo " --disable-blobs disable installing provided firmware blobs"
@@ -1713,6 +1720,29 @@ EOF
fi
##########################################
+# libcap-ng library probe
+if test "$cap" != "no" ; then
+ cap_libs="-lcap-ng"
+ cat > $TMPC << EOF
+#include <cap-ng.h>
+int main(void)
+{
+ capng_capability_to_name(CAPNG_EFFECTIVE);
+ return 0;
+}
+EOF
+ if compile_prog "" "$cap_libs" ; then
+ cap=yes
+ libs_tools="$cap_libs $libs_tools"
+ else
+ if test "$cap" = "yes" ; then
+ feature_not_found "cap"
+ fi
+ cap=no
+ fi
+fi
+
+##########################################
# Sound support libraries probe
audio_drv_probe()
@@ -2839,6 +2869,7 @@ echo "fdatasync $fdatasync"
echo "madvise $madvise"
echo "posix_madvise $posix_madvise"
echo "uuid support $uuid"
+echo "libcap-ng support $cap"
echo "vhost-net support $vhost_net"
echo "Trace backend $trace_backend"
echo "Trace output file $trace_file-<pid>"
@@ -2957,6 +2988,9 @@ fi
if test "$vde" = "yes" ; then
echo "CONFIG_VDE=y" >> $config_host_mak
fi
+if test "$cap" = "yes" ; then
+ echo "CONFIG_LIBCAP=y" >> $config_host_mak
+fi
for card in $audio_card_list; do
def=CONFIG_`echo $card | tr '[:lower:]' '[:upper:]'`
echo "$def=y" >> $config_host_mak
diff --git a/qemu-bridge-helper.c b/qemu-bridge-helper.c
index 2f137c2..b52038d 100644
--- a/qemu-bridge-helper.c
+++ b/qemu-bridge-helper.c
@@ -37,6 +37,10 @@
#include "net/tap-linux.h"
+#ifdef CONFIG_LIBCAP
+#include <cap-ng.h>
+#endif
+
#define DEFAULT_ACL_FILE CONFIG_QEMU_CONFDIR "/bridge.conf"
enum {
@@ -185,6 +189,27 @@ static int send_fd(int c, int fd)
return sendmsg(c, &msg, 0);
}
+#ifdef CONFIG_LIBCAP
+static int drop_privileges(void)
+{
+ /* clear all capabilities */
+ capng_clear(CAPNG_SELECT_BOTH);
+
+ if (capng_update(CAPNG_ADD, CAPNG_EFFECTIVE | CAPNG_PERMITTED,
+ CAP_NET_ADMIN) < 0) {
+ return -1;
+ }
+
+ /* change to calling user's real uid and gid, retaining supplemental
+ * groups and CAP_NET_ADMIN */
+ if (capng_change_id(getuid(), getgid(), CAPNG_CLEAR_BOUNDING)) {
+ return -1;
+ }
+
+ return 0;
+}
+#endif
+
int main(int argc, char **argv)
{
struct ifreq ifr;
@@ -199,6 +224,17 @@ int main(int argc, char **argv)
int access_allowed, access_denied;
int ret = EXIT_SUCCESS;
+#ifdef CONFIG_LIBCAP
+ /* if we're run from an suid binary, immediately drop privileges preserving
+ * cap_net_admin */
+ if (geteuid() == 0 && getuid() != geteuid()) {
+ if (drop_privileges() == -1) {
+ fprintf(stderr, "failed to drop privileges\n");
+ return 1;
+ }
+ }
+#endif
+
/* parse arguments */
if (argc < 3 || argc > 4) {
fprintf(stderr, "Usage: %s [--use-vnet] BRIDGE FD\n", argv[0]);
--
1.7.3.4
next prev parent reply other threads:[~2011-12-19 13:12 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-12-19 13:11 [Qemu-devel] [PATCH v6 0/4] -net bridge: rootless bridge support for qemu Corey Bryant
2011-12-19 13:11 ` [Qemu-devel] [PATCH v6 1/4] Add basic version of bridge helper Corey Bryant
2011-12-19 13:11 ` [Qemu-devel] [PATCH v6 2/4] Add access control support to qemu " Corey Bryant
2011-12-19 13:11 ` Corey Bryant [this message]
2011-12-19 13:11 ` [Qemu-devel] [PATCH v6 4/4] Add support for net bridge Corey Bryant
2011-12-19 19:36 ` Anthony Liguori
2011-12-19 22:55 ` Corey Bryant
2011-12-19 23:15 ` Anthony Liguori
2011-12-20 17:13 ` Corey Bryant
2011-12-22 15:54 ` Anthony Liguori
2011-12-20 10:02 ` Hui Kai Ran
2011-12-20 10:58 ` Hui Kai Ran
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1324300318-3419-4-git-send-email-coreyb@linux.vnet.ibm.com \
--to=coreyb@linux.vnet.ibm.com \
--cc=aliguori@us.ibm.com \
--cc=qemu-devel@nongnu.org \
--cc=rmarwah@linux.vnet.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.