os-posix: Provide new -runas <uid>:<gid> facility

This allows the caller to specify a uid and gid to use, even if there
is no corresponding password entry.  This will be useful in certain
Xen configurations.

We don't support just -runas <uid> because: (i) deprivileging without
calling setgroups would be ineffective (ii) given only a uid we don't
know what gid we ought to use (since uids may eppear in multiple
passwd file entries with different gids).

Signed-off-by: Ian Jackson <Ian.Jackson@eu.citrix.com>
Reviewed-by: Anthony PERARD <anthony.perard@citrix.com>
CC: Paolo Bonzini <pbonzini@redhat.com>
CC: Markus Armbruster <armbru@redhat.com>
CC: Daniel P. Berrange <berrange@redhat.com>
CC: Michael Tokarev <mjt@tls.msk.ru>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
This commit is contained in:
Ian Jackson 2017-09-15 18:10:44 +01:00 committed by Ian Jackson
parent f0a2171bf9
commit 2c42f1e801
2 changed files with 67 additions and 13 deletions

View file

@ -3765,7 +3765,8 @@ ETEXI
#ifndef _WIN32
DEF("runas", HAS_ARG, QEMU_OPTION_runas, \
"-runas user change to user id user just before starting the VM\n",
"-runas user change to user id user just before starting the VM\n" \
" user can be numeric uid:gid instead\n",
QEMU_ARCH_ALL)
#endif
STEXI