[PATCH] qemu-options: Deprecate "-runas" and introduce "-run-with user=..." instead

[PATCH] qemu-options: Deprecate "-runas" and introduce "-run-with user=..." instead

[Thomas Huth]

The old "-runas" option has the disadvantage that it is not visible
in the QAPI schema, so it is not available via the normal introspection
mechanisms. We've recently introduced the "-run-with" option for exactly
this purpose, which is meant to handle the options that affect the
runtime behavior. Thus let's introduce a "user=..." parameter here now
and deprecate the old "-runas" option.

Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 docs/about/deprecated.rst |  6 ++++++
 system/vl.c               | 15 +++++++++++++++
 qemu-options.hx           | 11 +++++++++--
 3 files changed, 30 insertions(+), 2 deletions(-)

diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst
index 7b548519b5..6b932961bc 100644
--- a/docs/about/deprecated.rst
+++ b/docs/about/deprecated.rst
@@ -61,6 +61,12 @@ configurations (e.g. -smp drawers=1,books=1,clusters=1 for x86 PC machine) is
 marked deprecated since 9.0, users have to ensure that all the topology members
 described with -smp are supported by the target machine.
 
+``-runas`` (since 9.1)
+----------------------
+
+Use ``-run-with user=..`` instead.
+
+
 User-mode emulator command line arguments
 -----------------------------------------
 
diff --git a/system/vl.c b/system/vl.c
index c644222982..cccca8e979 100644
--- a/system/vl.c
+++ b/system/vl.c
@@ -770,6 +770,10 @@ static QemuOptsList qemu_run_with_opts = {
             .name = "chroot",
             .type = QEMU_OPT_STRING,
         },
+        {
+            .name = "user",
+            .type = QEMU_OPT_STRING,
+        },
         { /* end of list */ }
     },
 };
@@ -3583,6 +3587,7 @@ void qemu_init(int argc, char **argv)
                 break;
 #if defined(CONFIG_POSIX)
             case QEMU_OPTION_runas:
+                warn_report("-runas is deprecated, use '-run-with user=...' instead");
                 if (!os_set_runas(optarg)) {
                     error_report("User \"%s\" doesn't exist"
                                  " (and is not <uid>:<gid>)",
@@ -3609,6 +3614,16 @@ void qemu_init(int argc, char **argv)
                 if (str) {
                     os_set_chroot(str);
                 }
+                str = qemu_opt_get(opts, "user");
+                if (str) {
+                    if (!os_set_runas(str)) {
+                        error_report("User \"%s\" doesn't exist"
+                                     " (and is not <uid>:<gid>)",
+                                     optarg);
+                        exit(1);
+                    }
+                }
+
                 break;
             }
 #endif /* CONFIG_POSIX */
diff --git a/qemu-options.hx b/qemu-options.hx
index 8ce85d4559..50912c7dab 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -4824,7 +4824,8 @@ DEF("runas", HAS_ARG, QEMU_OPTION_runas, \
 SRST
 ``-runas user``
     Immediately before starting guest execution, drop root privileges,
-    switching to the specified user.
+    switching to the specified user. This option is deprecated, use
+    ``-run-with user=...`` instead.
 ERST
 
 DEF("prom-env", HAS_ARG, QEMU_OPTION_prom_env,
@@ -4993,7 +4994,9 @@ DEF("run-with", HAS_ARG, QEMU_OPTION_run_with,
     "-run-with [async-teardown=on|off][,chroot=dir]\n"
     "                Set miscellaneous QEMU process lifecycle options:\n"
     "                async-teardown=on enables asynchronous teardown (Linux only)\n"
-    "                chroot=dir chroot to dir just before starting the VM\n",
+    "                chroot=dir chroot to dir just before starting the VM\n"
+    "                user=username switch to the specified user before starting the VM\n"
+    "                user=uid:gid dito, but use specified user-ID and group-ID instead\n",
     QEMU_ARCH_ALL)
 SRST
 ``-run-with [async-teardown=on|off][,chroot=dir]``
@@ -5013,6 +5016,10 @@ SRST
     ``chroot=dir`` can be used for doing a chroot to the specified directory
     immediately before starting the guest execution. This is especially useful
     in combination with -runas.
+
+    ``user=username`` or ``user=uid:gid`` can be used to drop root privileges
+    by switching to the specified user (via username) or user and group
+    (via uid:gid) immediately before starting guest execution.
 ERST
 #endif
 
-- 
2.44.0

Re: [PATCH] qemu-options: Deprecate "-runas" and introduce "-run-with user=..." instead

[Philippe Mathieu-Daudé]

On 15/4/24 20:39, Thomas Huth wrote:
> The old "-runas" option has the disadvantage that it is not visible
> in the QAPI schema, so it is not available via the normal introspection
> mechanisms. We've recently introduced the "-run-with" option for exactly
> this purpose, which is meant to handle the options that affect the
> runtime behavior. Thus let's introduce a "user=..." parameter here now
> and deprecate the old "-runas" option.
> 
> Signed-off-by: Thomas Huth <thuth@redhat.com>
> ---
>   docs/about/deprecated.rst |  6 ++++++
>   system/vl.c               | 15 +++++++++++++++
>   qemu-options.hx           | 11 +++++++++--
>   3 files changed, 30 insertions(+), 2 deletions(-)


> diff --git a/qemu-options.hx b/qemu-options.hx
> index 8ce85d4559..50912c7dab 100644
> --- a/qemu-options.hx
> +++ b/qemu-options.hx
> @@ -4824,7 +4824,8 @@ DEF("runas", HAS_ARG, QEMU_OPTION_runas, \
>   SRST
>   ``-runas user``
>       Immediately before starting guest execution, drop root privileges,
> -    switching to the specified user.
> +    switching to the specified user. This option is deprecated, use
> +    ``-run-with user=...`` instead.
>   ERST
>   
>   DEF("prom-env", HAS_ARG, QEMU_OPTION_prom_env,
> @@ -4993,7 +4994,9 @@ DEF("run-with", HAS_ARG, QEMU_OPTION_run_with,
>       "-run-with [async-teardown=on|off][,chroot=dir]\n"

"-run-with [async-teardown=on|off][,chroot=dir][user=username|uid:gid]\n"

>       "                Set miscellaneous QEMU process lifecycle options:\n"
>       "                async-teardown=on enables asynchronous teardown (Linux only)\n"
> -    "                chroot=dir chroot to dir just before starting the VM\n",
> +    "                chroot=dir chroot to dir just before starting the VM\n"
> +    "                user=username switch to the specified user before starting the VM\n"
> +    "                user=uid:gid dito, but use specified user-ID and group-ID instead\n",
>       QEMU_ARCH_ALL)
>   SRST
>   ``-run-with [async-teardown=on|off][,chroot=dir]``

Ditto.

> @@ -5013,6 +5016,10 @@ SRST
>       ``chroot=dir`` can be used for doing a chroot to the specified directory
>       immediately before starting the guest execution. This is especially useful
>       in combination with -runas.
> +
> +    ``user=username`` or ``user=uid:gid`` can be used to drop root privileges
> +    by switching to the specified user (via username) or user and group
> +    (via uid:gid) immediately before starting guest execution.
>   ERST
>   #endif
>