Add cap reduction support to enable use as SUID
The ideal way to use qemu-bridge-helper is to give it an fscap of using: setcap cap_net_admin=ep qemu-bridge-helper Unfortunately, most distros still do not have a mechanism to package files with fscaps applied. This means they'll have to SUID the qemu-bridge-helper binary. To improve security, use libcap to reduce our capability set to just cap_net_admin, then reduce privileges down to the calling user. This is hopefully close to equivalent to fscap support from a security perspective. Signed-off-by: Anthony Liguori <aliguori@us.ibm.com> Signed-off-by: Richa Marwaha <rmarwah@linux.vnet.ibm.com> Signed-off-by: Corey Bryant <coreyb@linux.vnet.ibm.com> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
This commit is contained in:
parent
bdef79a299
commit
47e98658f5
|
@ -133,6 +133,7 @@ vnc_thread="no"
|
||||||
xen=""
|
xen=""
|
||||||
xen_ctrl_version=""
|
xen_ctrl_version=""
|
||||||
linux_aio=""
|
linux_aio=""
|
||||||
|
cap_ng=""
|
||||||
attr=""
|
attr=""
|
||||||
libattr=""
|
libattr=""
|
||||||
xfs=""
|
xfs=""
|
||||||
|
@ -672,6 +673,10 @@ for opt do
|
||||||
;;
|
;;
|
||||||
--enable-tcg-interpreter) tcg_interpreter="yes"
|
--enable-tcg-interpreter) tcg_interpreter="yes"
|
||||||
;;
|
;;
|
||||||
|
--disable-cap-ng) cap_ng="no"
|
||||||
|
;;
|
||||||
|
--enable-cap-ng) cap_ng="yes"
|
||||||
|
;;
|
||||||
--disable-spice) spice="no"
|
--disable-spice) spice="no"
|
||||||
;;
|
;;
|
||||||
--enable-spice) spice="yes"
|
--enable-spice) spice="yes"
|
||||||
|
@ -1053,6 +1058,8 @@ echo " --disable-vde disable support for vde network"
|
||||||
echo " --enable-vde enable support for vde network"
|
echo " --enable-vde enable support for vde network"
|
||||||
echo " --disable-linux-aio disable Linux AIO support"
|
echo " --disable-linux-aio disable Linux AIO support"
|
||||||
echo " --enable-linux-aio enable Linux AIO support"
|
echo " --enable-linux-aio enable Linux AIO support"
|
||||||
|
echo " --disable-cap-ng disable libcap-ng support"
|
||||||
|
echo " --enable-cap-ng enable libcap-ng support"
|
||||||
echo " --disable-attr disables attr and xattr support"
|
echo " --disable-attr disables attr and xattr support"
|
||||||
echo " --enable-attr enable attr and xattr support"
|
echo " --enable-attr enable attr and xattr support"
|
||||||
echo " --disable-blobs disable installing provided firmware blobs"
|
echo " --disable-blobs disable installing provided firmware blobs"
|
||||||
|
@ -1744,6 +1751,29 @@ EOF
|
||||||
fi
|
fi
|
||||||
fi
|
fi
|
||||||
|
|
||||||
|
##########################################
|
||||||
|
# libcap-ng library probe
|
||||||
|
if test "$cap_ng" != "no" ; then
|
||||||
|
cap_libs="-lcap-ng"
|
||||||
|
cat > $TMPC << EOF
|
||||||
|
#include <cap-ng.h>
|
||||||
|
int main(void)
|
||||||
|
{
|
||||||
|
capng_capability_to_name(CAPNG_EFFECTIVE);
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
EOF
|
||||||
|
if compile_prog "" "$cap_libs" ; then
|
||||||
|
cap_ng=yes
|
||||||
|
libs_tools="$cap_libs $libs_tools"
|
||||||
|
else
|
||||||
|
if test "$cap_ng" = "yes" ; then
|
||||||
|
feature_not_found "cap_ng"
|
||||||
|
fi
|
||||||
|
cap_ng=no
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
|
||||||
##########################################
|
##########################################
|
||||||
# Sound support libraries probe
|
# Sound support libraries probe
|
||||||
|
|
||||||
|
@ -2876,6 +2906,7 @@ echo "fdatasync $fdatasync"
|
||||||
echo "madvise $madvise"
|
echo "madvise $madvise"
|
||||||
echo "posix_madvise $posix_madvise"
|
echo "posix_madvise $posix_madvise"
|
||||||
echo "uuid support $uuid"
|
echo "uuid support $uuid"
|
||||||
|
echo "libcap-ng support $cap_ng"
|
||||||
echo "vhost-net support $vhost_net"
|
echo "vhost-net support $vhost_net"
|
||||||
echo "Trace backend $trace_backend"
|
echo "Trace backend $trace_backend"
|
||||||
echo "Trace output file $trace_file-<pid>"
|
echo "Trace output file $trace_file-<pid>"
|
||||||
|
@ -2980,6 +3011,9 @@ fi
|
||||||
if test "$vde" = "yes" ; then
|
if test "$vde" = "yes" ; then
|
||||||
echo "CONFIG_VDE=y" >> $config_host_mak
|
echo "CONFIG_VDE=y" >> $config_host_mak
|
||||||
fi
|
fi
|
||||||
|
if test "$cap_ng" = "yes" ; then
|
||||||
|
echo "CONFIG_LIBCAP=y" >> $config_host_mak
|
||||||
|
fi
|
||||||
for card in $audio_card_list; do
|
for card in $audio_card_list; do
|
||||||
def=CONFIG_`echo $card | tr '[:lower:]' '[:upper:]'`
|
def=CONFIG_`echo $card | tr '[:lower:]' '[:upper:]'`
|
||||||
echo "$def=y" >> $config_host_mak
|
echo "$def=y" >> $config_host_mak
|
||||||
|
|
|
@ -39,6 +39,10 @@
|
||||||
|
|
||||||
#include "net/tap-linux.h"
|
#include "net/tap-linux.h"
|
||||||
|
|
||||||
|
#ifdef CONFIG_LIBCAP
|
||||||
|
#include <cap-ng.h>
|
||||||
|
#endif
|
||||||
|
|
||||||
#define DEFAULT_ACL_FILE CONFIG_QEMU_CONFDIR "/bridge.conf"
|
#define DEFAULT_ACL_FILE CONFIG_QEMU_CONFDIR "/bridge.conf"
|
||||||
|
|
||||||
enum {
|
enum {
|
||||||
|
@ -193,6 +197,27 @@ static int send_fd(int c, int fd)
|
||||||
return sendmsg(c, &msg, 0);
|
return sendmsg(c, &msg, 0);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
#ifdef CONFIG_LIBCAP
|
||||||
|
static int drop_privileges(void)
|
||||||
|
{
|
||||||
|
/* clear all capabilities */
|
||||||
|
capng_clear(CAPNG_SELECT_BOTH);
|
||||||
|
|
||||||
|
if (capng_update(CAPNG_ADD, CAPNG_EFFECTIVE | CAPNG_PERMITTED,
|
||||||
|
CAP_NET_ADMIN) < 0) {
|
||||||
|
return -1;
|
||||||
|
}
|
||||||
|
|
||||||
|
/* change to calling user's real uid and gid, retaining supplemental
|
||||||
|
* groups and CAP_NET_ADMIN */
|
||||||
|
if (capng_change_id(getuid(), getgid(), CAPNG_CLEAR_BOUNDING)) {
|
||||||
|
return -1;
|
||||||
|
}
|
||||||
|
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
#endif
|
||||||
|
|
||||||
int main(int argc, char **argv)
|
int main(int argc, char **argv)
|
||||||
{
|
{
|
||||||
struct ifreq ifr;
|
struct ifreq ifr;
|
||||||
|
@ -207,6 +232,17 @@ int main(int argc, char **argv)
|
||||||
int access_allowed, access_denied;
|
int access_allowed, access_denied;
|
||||||
int ret = EXIT_SUCCESS;
|
int ret = EXIT_SUCCESS;
|
||||||
|
|
||||||
|
#ifdef CONFIG_LIBCAP
|
||||||
|
/* if we're run from an suid binary, immediately drop privileges preserving
|
||||||
|
* cap_net_admin */
|
||||||
|
if (geteuid() == 0 && getuid() != geteuid()) {
|
||||||
|
if (drop_privileges() == -1) {
|
||||||
|
fprintf(stderr, "failed to drop privileges\n");
|
||||||
|
return 1;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
#endif
|
||||||
|
|
||||||
/* parse arguments */
|
/* parse arguments */
|
||||||
for (index = 1; index < argc; index++) {
|
for (index = 1; index < argc; index++) {
|
||||||
if (strcmp(argv[index], "--use-vnet") == 0) {
|
if (strcmp(argv[index], "--use-vnet") == 0) {
|
||||||
|
|
Reference in New Issue