From mboxrd@z Thu Jan 1 00:00:00 1970 From: Dario Faggioli Subject: Re: [PATCH v6] run QEMU as non-root Date: Wed, 1 Jul 2015 17:29:03 +0200 Message-ID: <1435764543.25170.389.camel@citrix.com> References: <1435755052-19447-1-git-send-email-stefano.stabellini@eu.citrix.com> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============9039379232186534160==" Return-path: In-Reply-To: <1435755052-19447-1-git-send-email-stefano.stabellini@eu.citrix.com> List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xen.org Errors-To: xen-devel-bounces@lists.xen.org To: Stefano Stabellini Cc: Ian.Jackson@eu.citrix.com, Jim Fehlig , xen-devel@lists.xensource.com, wei.liu2@citrix.com, ian.campbell@citrix.com List-Id: xen-devel@lists.xenproject.org --===============9039379232186534160== Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="=-xOmDOGYMt7NPIeT7arBe" --=-xOmDOGYMt7NPIeT7arBe Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Wed, 2015-07-01 at 13:50 +0100, Stefano Stabellini wrote: > --- /dev/null > +++ b/docs/misc/qemu-deprivilege.txt > @@ -0,0 +1,31 @@ > +For security reasons, libxl tries to pass a non-root username to QEMU as > +argument. During initialization QEMU calls setuid and setgid with the > +user ID and the group ID of the user passed as argument. > +Libxl looks for the following users in this order: > + > +1) a user named "xen-qemuuser-domid$domid",=20 > +Where $domid is the domid of the domain being created. > +This requires the reservation of 65535 uids from xen-qemuuser-domid1 > +to xen-qemuuser-domid65535. To use this mechanism, you might want to > +create a large number of users at installation time. For example: > + > +for ((i=3D1; i<65536; i++)) > +do > + adduser --no-create-home --system xen-qemuuser-domid$i > +done > + > +You might want to consider passing --group to adduser to create a new > +group for each new user. > + This is, IMHO, a lot of policing, for something like libxl. I'm saying this only now because, although always being always dubious about it, it was Jim's comment to v5 that made me realize it properly, and you're own reply to him in that thread, would actually be a great alternative! In fact, what about: * in libxl: - provide and honour (as first option) device_model_user, as you're=20 doing here; - if the above is not provided, check the availability of the=20 'shared' user, and use it if it's there; - if that is not there either, use root. * in xl (as you said yourself in v5's review): - build up the per-domain username and (if available) use device_model_user to pass it to libxl. Regards, Dario --=20 <> (Raistlin Majere) ----------------------------------------------------------------- Dario Faggioli, Ph.D, http://about.me/dario.faggioli Senior Software Engineer, Citrix Systems R&D Ltd., Cambridge (UK) --=-xOmDOGYMt7NPIeT7arBe Content-Type: application/pgp-signature; name="signature.asc" Content-Description: This is a digitally signed message part Content-Transfer-Encoding: 7bit -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iEYEABECAAYFAlWUBz8ACgkQk4XaBE3IOsSgTQCgoGAkRR7C5DQTqKc/XRXWfw7M daMAoJy3Fau3y0IHwvzaQs5frurTEwl0 =QlZi -----END PGP SIGNATURE----- --=-xOmDOGYMt7NPIeT7arBe-- --===============9039379232186534160== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Xen-devel mailing list Xen-devel@lists.xen.org http://lists.xen.org/xen-devel --===============9039379232186534160==--