[PATCH v10] run QEMU as non-root

[PATCH v10] run QEMU as non-root

[Stefano Stabellini]

Try to use "xen-qemuuser-domid$domid" first, then
"xen-qemuuser-shared" and root if everything else fails.

The uids need to be manually created by the user or, more likely, by the
xen package maintainer.

Expose a device_model_user setting in libxl_domain_build_info, so that
opinionated callers, such as libvirt, can set any user they like. Do not
fall back to root if device_model_user is set. Users can also set
device_model_user by hand in the xl domain config file.

QEMU is going to setuid and setgid to the user ID and the group ID of
the specified user, soon after initialization, before starting to deal
with any guest IO.

To actually secure QEMU when running in Dom0, we need at least to
deprivilege the privcmd and xenstore interfaces, this is just the first
step in that direction.

Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>

---

Changes in v10:
- rebase
- git add docs/misc/qemu-deprivilege.txt
- fix commit message to reflect the names chosen (xen-qemudepriv ->
  xen-qemuuser)

Changes in v9:
- add a device_model_user option to the xl domain config file

Changes in v8:
- no need to pass the -runas option if the user requested for root
- return ERROR_FAIL from libxl__dm_runas_helper in case of errors
- return NULL from libxl__build_device_model_args_new if libxl__dm_runas_helper failed
- fix line too long
- remove setting errno
- replace retry goto loop, with a while loop
- const char * as argument to libxl__dm_runas_helper
- fix comment

Changes in v7:
- do not fall back to root if the user explicitly set
b_info->device_model_user.

Changes in v6:
- add device_model_user to libxl_domain_build_info
- improve doc
- improve wording in commit message

Changes in v5:
- improve wording in doc
- fix wording in warning message
- fix example in doc
- drop xen-qemudepriv-$domname

Changes in v4:
- rename qemu-deprivilege to qemu-deprivilege.txt
- add a note about qemu-deprivilege.txt to INSTALL
- instead of xen-qemudepriv-base + $domid, try xen-qemudepriv-domid$domid
- introduce libxl__dm_runas_helper to make the code nicer

Changes in v3:
- clarify doc
- handle errno == ERANGE
---
 INSTALL                        |    7 +++++
 docs/man/xl.cfg.pod.5          |    5 +++
 docs/misc/qemu-deprivilege.txt |   31 +++++++++++++++++++
 tools/libxl/libxl.h            |    5 +++
 tools/libxl/libxl_dm.c         |   67 +++++++++++++++++++++++++++++++++++++++-
 tools/libxl/libxl_internal.h   |    5 +++
 tools/libxl/libxl_types.idl    |    1 +
 tools/libxl/xl_cmdimpl.c       |    3 ++
 8 files changed, 123 insertions(+), 1 deletion(-)
 create mode 100644 docs/misc/qemu-deprivilege.txt

diff --git a/INSTALL b/INSTALL
index 56e2950..b7e426c 100644
--- a/INSTALL
+++ b/INSTALL
@@ -304,6 +304,13 @@ systemctl enable xendomains.service
 systemctl enable xen-watchdog.service
 
 
+QEMU Deprivilege
+================
+It is recommended to run QEMU as non-root.
+See docs/misc/qemu-deprivilege.txt for an explanation on what you need
+to do at installation time to run QEMU as a dedicated user.
+
+
 History of options
 ==================
 
diff --git a/docs/man/xl.cfg.pod.5 b/docs/man/xl.cfg.pod.5
index b63846a..2aca8dd 100644
--- a/docs/man/xl.cfg.pod.5
+++ b/docs/man/xl.cfg.pod.5
@@ -1825,6 +1825,11 @@ Pass additional arbitrary options on the device-model command line for
 an HVM device model only. Each element in the list is passed as an
 option to the device-model.
 
+=item B<device_model_user="username">
+
+Run the device model as user "username", instead of
+xen-qemudepriv-domid$domid or xen-qemudepriv-shared or root.
+
 =back
 
 =head2 Keymaps
diff --git a/docs/misc/qemu-deprivilege.txt b/docs/misc/qemu-deprivilege.txt
new file mode 100644
index 0000000..dde74ab
--- /dev/null
+++ b/docs/misc/qemu-deprivilege.txt
@@ -0,0 +1,31 @@
+For security reasons, libxl tries to pass a non-root username to QEMU as
+argument. During initialization QEMU calls setuid and setgid with the
+user ID and the group ID of the user passed as argument.
+Libxl looks for the following users in this order:
+
+1) a user named "xen-qemuuser-domid$domid",
+Where $domid is the domid of the domain being created.
+This requires the reservation of 65535 uids from xen-qemuuser-domid1
+to xen-qemuuser-domid65535. To use this mechanism, you might want to
+create a large number of users at installation time. For example:
+
+for ((i=1; i<65536; i++))
+do
+    adduser --no-create-home --system xen-qemuuser-domid$i
+done
+
+You might want to consider passing --group to adduser to create a new
+group for each new user.
+
+
+2) a user named "xen-qemuuser-shared"
+As a fall back if both 1) fails, libxl will use a single user for
+all QEMU instances. The user is named xen-qemuuser-shared. This is
+less secure but still better than running QEMU as root. Using this is as
+simple as creating just one more user on your host:
+
+adduser --no-create-home --system xen-qemuuser-shared
+
+
+3) root
+As a last resort, libxl will start QEMU as root.
diff --git a/tools/libxl/libxl.h b/tools/libxl/libxl.h
index 168fedd..5edeb30 100644
--- a/tools/libxl/libxl.h
+++ b/tools/libxl/libxl.h
@@ -199,6 +199,11 @@
  */
 #define LIBXL_HAVE_DEVICETREE_PASSTHROUGH 1
 
+/* libxl_domain_build_info has device_model_user to specify the user to
+ * run the device model with. See docs/misc/qemu-deprivilege.txt.
+ */
+#define LIBXL_HAVE_DEVICE_MODEL_USER 1
+
 /*
  * libxl_domain_build_info has the arm.gic_version field.
  */
diff --git a/tools/libxl/libxl_dm.c b/tools/libxl/libxl_dm.c
index 9c9eaa3..151b6ed 100644
--- a/tools/libxl/libxl_dm.c
+++ b/tools/libxl/libxl_dm.c
@@ -21,6 +21,8 @@
 
 #include <xc_dom.h>
 #include <xen/hvm/e820.h>
+#include <sys/types.h>
+#include <pwd.h>
 
 static const char *libxl_tapif_script(libxl__gc *gc)
 {
@@ -722,6 +724,36 @@ libxl__detect_gfx_passthru_kind(libxl__gc *gc,
     return LIBXL_GFX_PASSTHRU_KIND_DEFAULT;
 }
 
+/* return 1 if the user was found, 0 if it was not, -1 on error */
+static int libxl__dm_runas_helper(libxl__gc *gc, const char *username)
+{
+    struct passwd pwd, *user = NULL;
+    char *buf = NULL;
+    long buf_size;
+    int ret;
+
+    buf_size = sysconf(_SC_GETPW_R_SIZE_MAX);
+    if (buf_size < 0) {
+        LOGE(ERROR, "sysconf(_SC_GETPW_R_SIZE_MAX) returned error %ld",
+                buf_size);
+        return ERROR_FAIL;
+    }
+
+    while (1) {
+        buf = libxl__realloc(gc, buf, buf_size);
+        ret = getpwnam_r(username, &pwd, buf, buf_size, &user);
+        if (ret == ERANGE) {
+            buf_size += 128;
+            continue;
+        }
+        if (ret != 0)
+            return ERROR_FAIL;
+        if (user != NULL)
+            return 1;
+        return 0;
+    }
+}
+
 static int libxl__build_device_model_args_new(libxl__gc *gc,
                                         const char *dm, int guest_domid,
                                         const libxl_domain_config *guest_config,
@@ -740,9 +772,10 @@ static int libxl__build_device_model_args_new(libxl__gc *gc,
     const char *keymap = dm_keymap(guest_config);
     char *machinearg;
     flexarray_t *dm_args, *dm_envs;
-    int i, connection, devid;
+    int i, connection, devid, ret;
     uint64_t ram_size;
     const char *path, *chardev;
+    char *user = NULL;
 
     dm_args = flexarray_make(gc, 16, 1);
     dm_envs = flexarray_make(gc, 16, 1);
@@ -1222,6 +1255,38 @@ static int libxl__build_device_model_args_new(libxl__gc *gc,
         default:
             break;
         }
+
+        if (b_info->device_model_user) {
+            user = b_info->device_model_user;
+            goto end_search;
+        }
+
+        user = libxl__sprintf(gc, "%s%d", LIBXL_QEMU_USER_BASE, guest_domid);
+        ret = libxl__dm_runas_helper(gc, user);
+        if (ret < 0)
+            return ret;
+        if (ret > 0)
+            goto end_search;
+
+        user = LIBXL_QEMU_USER_SHARED;
+        ret = libxl__dm_runas_helper(gc, user);
+        if (ret < 0)
+            return ret;
+        if (ret > 0) {
+            LOG(WARN, "Could not find user %s%d, falling back to %s",
+                    LIBXL_QEMU_USER_BASE, guest_domid, LIBXL_QEMU_USER_SHARED);
+            goto end_search;
+        }
+
+        user = NULL;
+        LOG(WARN, "Could not find user %s, starting QEMU as root",
+            LIBXL_QEMU_USER_SHARED);
+
+end_search:
+        if (user != NULL && strcmp(user, "root")) {
+            flexarray_append(dm_args, "-runas");
+            flexarray_append(dm_args, user);
+        }
     }
     flexarray_append(dm_args, NULL);
     *args = (char **) flexarray_contents(dm_args);
diff --git a/tools/libxl/libxl_internal.h b/tools/libxl/libxl_internal.h
index b00add0..952b668 100644
--- a/tools/libxl/libxl_internal.h
+++ b/tools/libxl/libxl_internal.h
@@ -4018,6 +4018,11 @@ void libxl__bitmap_copy_best_effort(libxl__gc *gc, libxl_bitmap *dptr,
                                     const libxl_bitmap *sptr);
 
 int libxl__count_physical_sockets(libxl__gc *gc, int *sockets);
+
+
+#define LIBXL_QEMU_USER_PREFIX "xen-qemuuser"
+#define LIBXL_QEMU_USER_BASE   LIBXL_QEMU_USER_PREFIX"-domid"
+#define LIBXL_QEMU_USER_SHARED LIBXL_QEMU_USER_PREFIX"-shared"
 #endif
 
 /*
diff --git a/tools/libxl/libxl_types.idl b/tools/libxl/libxl_types.idl
index 4d78f86..6808f2b 100644
--- a/tools/libxl/libxl_types.idl
+++ b/tools/libxl/libxl_types.idl
@@ -440,6 +440,7 @@ libxl_domain_build_info = Struct("domain_build_info",[
     ("device_model",     string),
     ("device_model_ssidref", uint32),
     ("device_model_ssid_label", string),
+    ("device_model_user", string),
 
     # extra parameters pass directly to qemu, NULL terminated
     ("extra",            libxl_string_list),
diff --git a/tools/libxl/xl_cmdimpl.c b/tools/libxl/xl_cmdimpl.c
index 03442e1..2b6371d 100644
--- a/tools/libxl/xl_cmdimpl.c
+++ b/tools/libxl/xl_cmdimpl.c
@@ -2201,6 +2201,9 @@ skip_vfb:
         xlu_cfg_replace_string(config, "device_model_stubdomain_seclabel",
                                &b_info->device_model_ssid_label, 0);
 
+    xlu_cfg_replace_string(config, "device_model_user",
+                           &b_info->device_model_user, 0);
+
 #define parse_extra_args(type)                                            \
     e = xlu_cfg_get_list_as_string_list(config, "device_model_args"#type, \
                                     &b_info->extra##type, 0);            \
-- 
1.7.10.4

Re: [PATCH v10] run QEMU as non-root

[Ian Campbell]

On Thu, 2015-11-05 at 12:47 +0000, Stefano Stabellini wrote:
> Try to use "xen-qemuuser-domid$domid" first, then
> "xen-qemuuser-shared" and root if everything else fails.
> 
> The uids need to be manually created by the user or, more likely, by the
> xen package maintainer.
> 
> Expose a device_model_user setting in libxl_domain_build_info, so that
> opinionated callers, such as libvirt, can set any user they like. Do not
> fall back to root if device_model_user is set. Users can also set
> device_model_user by hand in the xl domain config file.
> 
> QEMU is going to setuid and setgid to the user ID and the group ID of
> the specified user, soon after initialization, before starting to deal
> with any guest IO.
> 
> To actually secure QEMU when running in Dom0, we need at least to
> deprivilege the privcmd and xenstore interfaces, this is just the first
> step in that direction.
> 
> Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>

acked + applied.

Re: [PATCH v10] run QEMU as non-root

[Ian Campbell]

On Thu, 2015-11-05 at 12:47 +0000, Stefano Stabellini wrote:
> diff --git a/docs/misc/qemu-deprivilege.txt b/docs/misc/qemu-
> deprivilege.txt
> new file mode 100644
> index 0000000..dde74ab
> --- /dev/null
> +++ b/docs/misc/qemu-deprivilege.txt
> @@ -0,0 +1,31 @@
> +For security reasons, libxl tries to pass a non-root username to QEMU as
> +argument. During initialization QEMU calls setuid and setgid with the
> +user ID and the group ID of the user passed as argument.
> +Libxl looks for the following users in this order:
> +
> +1) a user named "xen-qemuuser-domid$domid",
> +Where $domid is the domid of the domain being created.
> +This requires the reservation of 65535 uids from xen-qemuuser-domid1
> +to xen-qemuuser-domid65535. To use this mechanism, you might want to
> +create a large number of users at installation time. For example:
> +
> +for ((i=1; i<65536; i++))
> +do
> +    adduser --no-create-home --system xen-qemuuser-domid$i
> +done

I suppose we should integrate either this or suggestion #2 into osstest.
Will you send a patch?

I suppose ts-xen-install is the obvious place to do this, only quirk might
be making it idempotent (for convenience when running in standalone mode).
The adduser manpage suggests it already is:
       0      The  user exists as specified. This can have 2 causes:
              The user was  created  by  adduser  or  the  user  was
              already  present  on  the  system  before  adduser was
              invoked. If adduser was returning 0 , invoking adduser
              a  second time with the same parameters as before also
              returns 0.

So hopefully that is trivial.

> 
> +You might want to consider passing --group to adduser to create a new
> +group for each new user.
> +
> +
> +2) a user named "xen-qemuuser-shared"
> +As a fall back if both 1) fails, libxl will use a single user for
> +all QEMU instances. The user is named xen-qemuuser-shared. This is
> +less secure but still better than running QEMU as root. Using this is as
> +simple as creating just one more user on your host:
> +
> +adduser --no-create-home --system xen-qemuuser-shared
> +
> +
> +3) root
> +As a last resort, libxl will start QEMU as root.
> diff --git a/tools/libxl/libxl.h b/tools/libxl/libxl.h
> index 168fedd..5edeb30 100644
> --- a/tools/libxl/libxl.h
> +++ b/tools/libxl/libxl.h
> @@ -199,6 +199,11 @@
>   */
>  #define LIBXL_HAVE_DEVICETREE_PASSTHROUGH 1
>  
> +/* libxl_domain_build_info has device_model_user to specify the user to
> + * run the device model with. See docs/misc/qemu-deprivilege.txt.
> + */
> +#define LIBXL_HAVE_DEVICE_MODEL_USER 1
> +
>  /*
>   * libxl_domain_build_info has the arm.gic_version field.
>   */
> diff --git a/tools/libxl/libxl_dm.c b/tools/libxl/libxl_dm.c
> index 9c9eaa3..151b6ed 100644
> --- a/tools/libxl/libxl_dm.c
> +++ b/tools/libxl/libxl_dm.c
> @@ -21,6 +21,8 @@
>  
>  #include <xc_dom.h>
>  #include <xen/hvm/e820.h>
> +#include <sys/types.h>
> +#include <pwd.h>
>  
>  static const char *libxl_tapif_script(libxl__gc *gc)
>  {
> @@ -722,6 +724,36 @@ libxl__detect_gfx_passthru_kind(libxl__gc *gc,
>      return LIBXL_GFX_PASSTHRU_KIND_DEFAULT;
>  }
>  
> +/* return 1 if the user was found, 0 if it was not, -1 on error */
> +static int libxl__dm_runas_helper(libxl__gc *gc, const char *username)
> +{
> +    struct passwd pwd, *user = NULL;
> +    char *buf = NULL;
> +    long buf_size;
> +    int ret;
> +
> +    buf_size = sysconf(_SC_GETPW_R_SIZE_MAX);
> +    if (buf_size < 0) {
> +        LOGE(ERROR, "sysconf(_SC_GETPW_R_SIZE_MAX) returned error %ld",
> +                buf_size);
> +        return ERROR_FAIL;
> +    }
> +
> +    while (1) {
> +        buf = libxl__realloc(gc, buf, buf_size);
> +        ret = getpwnam_r(username, &pwd, buf, buf_size, &user);
> +        if (ret == ERANGE) {
> +            buf_size += 128;
> +            continue;
> +        }
> +        if (ret != 0)
> +            return ERROR_FAIL;
> +        if (user != NULL)
> +            return 1;
> +        return 0;
> +    }
> +}
> +
>  static int libxl__build_device_model_args_new(libxl__gc *gc,
>                                          const char *dm, int guest_domid,
>                                          const libxl_domain_config
> *guest_config,
> @@ -740,9 +772,10 @@ static int
> libxl__build_device_model_args_new(libxl__gc *gc,
>      const char *keymap = dm_keymap(guest_config);
>      char *machinearg;
>      flexarray_t *dm_args, *dm_envs;
> -    int i, connection, devid;
> +    int i, connection, devid, ret;
>      uint64_t ram_size;
>      const char *path, *chardev;
> +    char *user = NULL;
>  
>      dm_args = flexarray_make(gc, 16, 1);
>      dm_envs = flexarray_make(gc, 16, 1);
> @@ -1222,6 +1255,38 @@ static int
> libxl__build_device_model_args_new(libxl__gc *gc,
>          default:
>              break;
>          }
> +
> +        if (b_info->device_model_user) {
> +            user = b_info->device_model_user;
> +            goto end_search;
> +        }
> +
> +        user = libxl__sprintf(gc, "%s%d", LIBXL_QEMU_USER_BASE,
> guest_domid);
> +        ret = libxl__dm_runas_helper(gc, user);
> +        if (ret < 0)
> +            return ret;
> +        if (ret > 0)
> +            goto end_search;
> +
> +        user = LIBXL_QEMU_USER_SHARED;
> +        ret = libxl__dm_runas_helper(gc, user);
> +        if (ret < 0)
> +            return ret;
> +        if (ret > 0) {
> +            LOG(WARN, "Could not find user %s%d, falling back to %s",
> +                    LIBXL_QEMU_USER_BASE, guest_domid,
> LIBXL_QEMU_USER_SHARED);
> +            goto end_search;
> +        }
> +
> +        user = NULL;
> +        LOG(WARN, "Could not find user %s, starting QEMU as root",
> +            LIBXL_QEMU_USER_SHARED);
> +
> +end_search:
> +        if (user != NULL && strcmp(user, "root")) {
> +            flexarray_append(dm_args, "-runas");
> +            flexarray_append(dm_args, user);
> +        }
>      }
>      flexarray_append(dm_args, NULL);
>      *args = (char **) flexarray_contents(dm_args);
> diff --git a/tools/libxl/libxl_internal.h b/tools/libxl/libxl_internal.h
> index b00add0..952b668 100644
> --- a/tools/libxl/libxl_internal.h
> +++ b/tools/libxl/libxl_internal.h
> @@ -4018,6 +4018,11 @@ void libxl__bitmap_copy_best_effort(libxl__gc *gc,
> libxl_bitmap *dptr,
>                                      const libxl_bitmap *sptr);
>  
>  int libxl__count_physical_sockets(libxl__gc *gc, int *sockets);
> +
> +
> +#define LIBXL_QEMU_USER_PREFIX "xen-qemuuser"
> +#define LIBXL_QEMU_USER_BASE   LIBXL_QEMU_USER_PREFIX"-domid"
> +#define LIBXL_QEMU_USER_SHARED LIBXL_QEMU_USER_PREFIX"-shared"
>  #endif
>  
>  /*
> diff --git a/tools/libxl/libxl_types.idl b/tools/libxl/libxl_types.idl
> index 4d78f86..6808f2b 100644
> --- a/tools/libxl/libxl_types.idl
> +++ b/tools/libxl/libxl_types.idl
> @@ -440,6 +440,7 @@ libxl_domain_build_info =
> Struct("domain_build_info",[
>      ("device_model",     string),
>      ("device_model_ssidref", uint32),
>      ("device_model_ssid_label", string),
> +    ("device_model_user", string),
>  
>      # extra parameters pass directly to qemu, NULL terminated
>      ("extra",            libxl_string_list),
> diff --git a/tools/libxl/xl_cmdimpl.c b/tools/libxl/xl_cmdimpl.c
> index 03442e1..2b6371d 100644
> --- a/tools/libxl/xl_cmdimpl.c
> +++ b/tools/libxl/xl_cmdimpl.c
> @@ -2201,6 +2201,9 @@ skip_vfb:
>          xlu_cfg_replace_string(config,
> "device_model_stubdomain_seclabel",
>                                 &b_info->device_model_ssid_label, 0);
>  
> +    xlu_cfg_replace_string(config, "device_model_user",
> +                           &b_info->device_model_user, 0);
> +
>  #define
> parse_extra_args(type)                                            \
>      e = xlu_cfg_get_list_as_string_list(config,
> "device_model_args"#type, \
>                                      &b_info->extra##type,
> 0);            \
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
http://lists.xen.org/xen-devel

Re: [PATCH v10] run QEMU as non-root

[George Dunlap]

On Thu, Nov 5, 2015 at 12:47 PM, Stefano Stabellini
<stefano.stabellini@eu.citrix.com> wrote:
> diff --git a/docs/misc/qemu-deprivilege.txt b/docs/misc/qemu-deprivilege.txt
> new file mode 100644
> index 0000000..dde74ab
> --- /dev/null
> +++ b/docs/misc/qemu-deprivilege.txt
> @@ -0,0 +1,31 @@
> +For security reasons, libxl tries to pass a non-root username to QEMU as
> +argument. During initialization QEMU calls setuid and setgid with the
> +user ID and the group ID of the user passed as argument.
> +Libxl looks for the following users in this order:
> +
> +1) a user named "xen-qemuuser-domid$domid",
> +Where $domid is the domid of the domain being created.
> +This requires the reservation of 65535 uids from xen-qemuuser-domid1
> +to xen-qemuuser-domid65535. To use this mechanism, you might want to
> +create a large number of users at installation time. For example:
> +
> +for ((i=1; i<65536; i++))
> +do
> +    adduser --no-create-home --system xen-qemuuser-domid$i
> +done

This fails for me after a few hundred uids:

adduser: No UID is available in the range 100-999 (FIRST_SYS_UID -
LAST_SYS_UID).
adduser: The user `xen-qemuuser-domid892' was not created.
adduser: No UID is available in the range 100-999 (FIRST_SYS_UID -
LAST_SYS_UID).
adduser: The user `xen-qemuuser-domid893' was not created.
adduser: No UID is available in the range 100-999 (FIRST_SYS_UID -
LAST_SYS_UID).
adduser: The user `xen-qemuuser-domid894' was not created.

It looks like even if --system were omitted, this would fail on a
normal system, as the default UID range looks to be [1000,29999].

Also, on my test box a single 'adduser' takes about 1 second, meaning
just doing up to the normal number of domains (around 32k) would take
9 hours or so; is that really a practical suggestion?

 -George

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel

Re: [PATCH v10] run QEMU as non-root

[Anthony PERARD]

On Wed, Mar 14, 2018 at 02:49:37PM +0000, George Dunlap wrote:
> On Thu, Nov 5, 2015 at 12:47 PM, Stefano Stabellini
> <stefano.stabellini@eu.citrix.com> wrote:
> > diff --git a/docs/misc/qemu-deprivilege.txt b/docs/misc/qemu-deprivilege.txt
> > new file mode 100644
> > index 0000000..dde74ab
> > --- /dev/null
> > +++ b/docs/misc/qemu-deprivilege.txt
> > @@ -0,0 +1,31 @@
> > +For security reasons, libxl tries to pass a non-root username to QEMU as
> > +argument. During initialization QEMU calls setuid and setgid with the
> > +user ID and the group ID of the user passed as argument.
> > +Libxl looks for the following users in this order:
> > +
> > +1) a user named "xen-qemuuser-domid$domid",
> > +Where $domid is the domid of the domain being created.
> > +This requires the reservation of 65535 uids from xen-qemuuser-domid1
> > +to xen-qemuuser-domid65535. To use this mechanism, you might want to
> > +create a large number of users at installation time. For example:
> > +
> > +for ((i=1; i<65536; i++))
> > +do
> > +    adduser --no-create-home --system xen-qemuuser-domid$i
> > +done
> 
> This fails for me after a few hundred uids:
> 
> adduser: No UID is available in the range 100-999 (FIRST_SYS_UID -
> LAST_SYS_UID).
> adduser: The user `xen-qemuuser-domid892' was not created.
> adduser: No UID is available in the range 100-999 (FIRST_SYS_UID -
> LAST_SYS_UID).
> adduser: The user `xen-qemuuser-domid893' was not created.
> adduser: No UID is available in the range 100-999 (FIRST_SYS_UID -
> LAST_SYS_UID).
> adduser: The user `xen-qemuuser-domid894' was not created.
> 
> It looks like even if --system were omitted, this would fail on a
> normal system, as the default UID range looks to be [1000,29999].
> 
> Also, on my test box a single 'adduser' takes about 1 second, meaning
> just doing up to the normal number of domains (around 32k) would take
> 9 hours or so; is that really a practical suggestion?

Using systemd, it's a bit faster:

for ((i=1; i<5000; i++)); do
  echo "u xen-qemuuser-domid$i -" >> /etc/sysusers.d/xen-qemu-depriv.conf;
done
$ time systemd-sysusers xen-qemu-depriv.conf
systemd-sysusers xen-qemu-depriv.conf  1.19s user 1.71s system 45% cpu 6.351 total

but that also fails to create user xen-qemuuser-domid940 and the
following. And uid for all new users was < 1000.

That works better if you start my little script here with:
echo "r - 2000-9000" >> /etc/sysusers.d/xen-qemu-depriv.conf
# for 5000 uid:
systemd-sysusers xen-qemu-depriv.conf  2.29s user 3.54s system 47% cpu 12.237 total


George, if you read the manual for dm_restrict, the first option
presented is to create a single userid that is the start of a range of
uid to use:

> Ideally, set aside a range of 32752 uids (from N to N+32751) and
> create a user whose name is xen-qemuuser-range-base and whose uid is N
> and whose gid is a plain unprivileged gid.  libxl will use one such
> user for each domid.

Which works fine.

-- 
Anthony PERARD

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel

Re: [PATCH v10] run QEMU as non-root

[George Dunlap]

On Wed, Mar 14, 2018 at 4:14 PM, Anthony PERARD
<anthony.perard@citrix.com> wrote:
> On Wed, Mar 14, 2018 at 02:49:37PM +0000, George Dunlap wrote:
>> On Thu, Nov 5, 2015 at 12:47 PM, Stefano Stabellini
>> <stefano.stabellini@eu.citrix.com> wrote:
>> > diff --git a/docs/misc/qemu-deprivilege.txt b/docs/misc/qemu-deprivilege.txt
>> > new file mode 100644
>> > index 0000000..dde74ab
>> > --- /dev/null
>> > +++ b/docs/misc/qemu-deprivilege.txt
>> > @@ -0,0 +1,31 @@
>> > +For security reasons, libxl tries to pass a non-root username to QEMU as
>> > +argument. During initialization QEMU calls setuid and setgid with the
>> > +user ID and the group ID of the user passed as argument.
>> > +Libxl looks for the following users in this order:
>> > +
>> > +1) a user named "xen-qemuuser-domid$domid",
>> > +Where $domid is the domid of the domain being created.
>> > +This requires the reservation of 65535 uids from xen-qemuuser-domid1
>> > +to xen-qemuuser-domid65535. To use this mechanism, you might want to
>> > +create a large number of users at installation time. For example:
>> > +
>> > +for ((i=1; i<65536; i++))
>> > +do
>> > +    adduser --no-create-home --system xen-qemuuser-domid$i
>> > +done
>>
>> This fails for me after a few hundred uids:
>>
>> adduser: No UID is available in the range 100-999 (FIRST_SYS_UID -
>> LAST_SYS_UID).
>> adduser: The user `xen-qemuuser-domid892' was not created.
>> adduser: No UID is available in the range 100-999 (FIRST_SYS_UID -
>> LAST_SYS_UID).
>> adduser: The user `xen-qemuuser-domid893' was not created.
>> adduser: No UID is available in the range 100-999 (FIRST_SYS_UID -
>> LAST_SYS_UID).
>> adduser: The user `xen-qemuuser-domid894' was not created.
>>
>> It looks like even if --system were omitted, this would fail on a
>> normal system, as the default UID range looks to be [1000,29999].
>>
>> Also, on my test box a single 'adduser' takes about 1 second, meaning
>> just doing up to the normal number of domains (around 32k) would take
>> 9 hours or so; is that really a practical suggestion?
>
> Using systemd, it's a bit faster:
>
> for ((i=1; i<5000; i++)); do
>   echo "u xen-qemuuser-domid$i -" >> /etc/sysusers.d/xen-qemu-depriv.conf;
> done
> $ time systemd-sysusers xen-qemu-depriv.conf
> systemd-sysusers xen-qemu-depriv.conf  1.19s user 1.71s system 45% cpu 6.351 total
>
> but that also fails to create user xen-qemuuser-domid940 and the
> following. And uid for all new users was < 1000.
>
> That works better if you start my little script here with:
> echo "r - 2000-9000" >> /etc/sysusers.d/xen-qemu-depriv.conf
> # for 5000 uid:
> systemd-sysusers xen-qemu-depriv.conf  2.29s user 3.54s system 47% cpu 12.237 total

Well, that may be, but *this particular document* doesn't mention
systemd, nor modifying the range of UIDs available; so it's not a
practical suggestion.

> George, if you read the manual for dm_restrict, the first option
> presented is to create a single userid that is the start of a range of
> uid to use:

Right, I did miss that from the man page -- but again, that option is
not mentioned here in this document.

A lot of the stuff in the man page there isn't really suitable for a
man page; it should be put in a separate document.

I'll submit some patches. :-)

 -George

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel