motorhead/qemu
1
0
Fork 0
mirror of https://github.com/Motorhead1991/qemu.git synced 2025-08-04 00:03:54 -06:00
Code Issues Projects Releases Packages Wiki Activity Actions

Add cap reduction support to enable use as SUID

Browse source 
The ideal way to use qemu-bridge-helper is to give it an fscap of using:

 setcap cap_net_admin=ep qemu-bridge-helper

Unfortunately, most distros still do not have a mechanism to package files
with fscaps applied.  This means they'll have to SUID the qemu-bridge-helper
binary.

To improve security, use libcap to reduce our capability set to just
cap_net_admin, then reduce privileges down to the calling user.  This is
hopefully close to equivalent to fscap support from a security perspective.

Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
Signed-off-by: Richa Marwaha <rmarwah@linux.vnet.ibm.com>
Signed-off-by: Corey Bryant <coreyb@linux.vnet.ibm.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
This commit is contained in:
Corey Bryant 2012-01-26 09:42:26 -05:00 • committed by Anthony Liguori
parent bdef79a299
commit 47e98658f5
2 changed files with 70 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

36
qemu-bridge-helper.c
View file

@ -39,6 +39,10 @@
#include "net/tap-linux.h"
#ifdef CONFIG_LIBCAP
#include <cap-ng.h>
#endif
#define DEFAULT_ACL_FILE CONFIG_QEMU_CONFDIR "/bridge.conf"
enum {
@ -193,6 +197,27 @@ static int send_fd(int c, int fd)
return sendmsg(c, &msg, 0);
}
#ifdef CONFIG_LIBCAP
static int drop_privileges(void)
{
/* clear all capabilities */
capng_clear(CAPNG_SELECT_BOTH);
if (capng_update(CAPNG_ADD, CAPNG_EFFECTIVE | CAPNG_PERMITTED,
CAP_NET_ADMIN) < 0) {
return -1;
}
/* change to calling user's real uid and gid, retaining supplemental
* groups and CAP_NET_ADMIN */
if (capng_change_id(getuid(), getgid(), CAPNG_CLEAR_BOUNDING)) {
return -1;
}
return 0;
}
#endif
int main(int argc, char **argv)
{
struct ifreq ifr;
@ -207,6 +232,17 @@ int main(int argc, char **argv)
int access_allowed, access_denied;
int ret = EXIT_SUCCESS;
#ifdef CONFIG_LIBCAP
/* if we're run from an suid binary, immediately drop privileges preserving
* cap_net_admin */
if (geteuid() == 0 && getuid() != geteuid()) {
if (drop_privileges() == -1) {
fprintf(stderr, "failed to drop privileges\n");
return 1;
}
}
#endif
/* parse arguments */
for (index = 1; index < argc; index++) {
if (strcmp(argv[index], "--use-vnet") == 0) {