[PATCH] [RFC] run QEMU as non-root

[Stefano Stabellini <stefano.stabellini@eu.citrix.com>]

Run QEMU as non-root. Starting from uid 6000, the chosen uid is
base+domid. If the uid doesn't exist, try just 6000. This is less
secure: ideally we don't want different domains having their QEMUs
running with the same uid. Finally if uid 6000 doesn't exist either,
fall back to running QEMU as root.

The uids need to be manually created by the user or, more likely, by the
xen package maintainer.

To actually secure QEMU when running in Dom0, we need at least to
deprivilege the privcmd and xenstore interfaces, this is just the first
step in that direction.

Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
---
 tools/libxl/libxl_dm.c       |   17 +++++++++++++++++
 tools/libxl/libxl_internal.h |    2 ++
 2 files changed, 19 insertions(+)

diff --git a/tools/libxl/libxl_dm.c b/tools/libxl/libxl_dm.c
index 0c6408d..942c5df 100644
--- a/tools/libxl/libxl_dm.c
+++ b/tools/libxl/libxl_dm.c
@@ -19,6 +19,8 @@
 
 #include "libxl_internal.h"
 #include <xen/hvm/e820.h>
+#include <sys/types.h>
+#include <pwd.h>
 
 static const char *libxl_tapif_script(libxl__gc *gc)
 {
@@ -439,6 +441,7 @@ static char ** libxl__build_device_model_args_new(libxl__gc *gc,
     int i, connection, devid;
     uint64_t ram_size;
     const char *path, *chardev;
+    struct passwd *user = NULL;
 
     dm_args = flexarray_make(gc, 16, 1);
 
@@ -878,6 +881,20 @@ static char ** libxl__build_device_model_args_new(libxl__gc *gc,
         default:
             break;
         }
+
+        user = getpwuid(LIBXL_QEMU_BASE_UID + guest_domid);
+        if (user == NULL) {
+            LIBXL__LOG(ctx, LIBXL__LOG_WARNING, "Could not find uid %d, falling back to %d\n",
+                    LIBXL_QEMU_BASE_UID + guest_domid, LIBXL_QEMU_BASE_UID);
+            user = getpwuid(LIBXL_QEMU_BASE_UID);
+            if (user == NULL)
+                LIBXL__LOG(ctx, LIBXL__LOG_WARNING, "Could not find uid %d, starting QEMU as root\n",
+                    LIBXL_QEMU_BASE_UID);
+        }
+        if (user) {
+            flexarray_append(dm_args, "-runas");
+            flexarray_append(dm_args, user->pw_name);
+        }
     }
     flexarray_append(dm_args, NULL);
     return (char **) flexarray_contents(dm_args);
diff --git a/tools/libxl/libxl_internal.h b/tools/libxl/libxl_internal.h
index 8eb38aa..065ff98 100644
--- a/tools/libxl/libxl_internal.h
+++ b/tools/libxl/libxl_internal.h
@@ -3692,6 +3692,8 @@ static inline void libxl__update_config_vtpm(libxl__gc *gc,
  */
 void libxl__bitmap_copy_best_effort(libxl__gc *gc, libxl_bitmap *dptr,
                                     const libxl_bitmap *sptr);
+
+#define LIBXL_QEMU_BASE_UID (6000)
 #endif
 
 /*
-- 
1.7.10.4