mirror of https://github.com/xemu-project/xemu.git
qemu-options: Deprecate "-runas" and introduce "-run-with user=..." instead
The old "-runas" option has the disadvantage that it is not visible in the QAPI schema, so it is not available via the normal introspection mechanisms. We've recently introduced the "-run-with" option for exactly this purpose, which is meant to handle the options that affect the runtime behavior. Thus let's introduce a "user=..." parameter here now and deprecate the old "-runas" option. Message-ID: <20240506112058.51446-1-thuth@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Thomas Huth <thuth@redhat.com>
This commit is contained in:
parent
6e55b32d45
commit
95e0fb0afa
|
@ -61,6 +61,12 @@ configurations (e.g. -smp drawers=1,books=1,clusters=1 for x86 PC machine) is
|
|||
marked deprecated since 9.0, users have to ensure that all the topology members
|
||||
described with -smp are supported by the target machine.
|
||||
|
||||
``-runas`` (since 9.1)
|
||||
----------------------
|
||||
|
||||
Use ``-run-with user=..`` instead.
|
||||
|
||||
|
||||
User-mode emulator command line arguments
|
||||
-----------------------------------------
|
||||
|
||||
|
|
|
@ -4824,7 +4824,8 @@ DEF("runas", HAS_ARG, QEMU_OPTION_runas, \
|
|||
SRST
|
||||
``-runas user``
|
||||
Immediately before starting guest execution, drop root privileges,
|
||||
switching to the specified user.
|
||||
switching to the specified user. This option is deprecated, use
|
||||
``-run-with user=...`` instead.
|
||||
ERST
|
||||
|
||||
DEF("prom-env", HAS_ARG, QEMU_OPTION_prom_env,
|
||||
|
@ -4990,13 +4991,15 @@ DEF("qtest-log", HAS_ARG, QEMU_OPTION_qtest_log, "", QEMU_ARCH_ALL)
|
|||
|
||||
#ifdef CONFIG_POSIX
|
||||
DEF("run-with", HAS_ARG, QEMU_OPTION_run_with,
|
||||
"-run-with [async-teardown=on|off][,chroot=dir]\n"
|
||||
"-run-with [async-teardown=on|off][,chroot=dir][user=username|uid:gid]\n"
|
||||
" Set miscellaneous QEMU process lifecycle options:\n"
|
||||
" async-teardown=on enables asynchronous teardown (Linux only)\n"
|
||||
" chroot=dir chroot to dir just before starting the VM\n",
|
||||
" chroot=dir chroot to dir just before starting the VM\n"
|
||||
" user=username switch to the specified user before starting the VM\n"
|
||||
" user=uid:gid ditto, but use specified user-ID and group-ID instead\n",
|
||||
QEMU_ARCH_ALL)
|
||||
SRST
|
||||
``-run-with [async-teardown=on|off][,chroot=dir]``
|
||||
``-run-with [async-teardown=on|off][,chroot=dir][user=username|uid:gid]``
|
||||
Set QEMU process lifecycle options.
|
||||
|
||||
``async-teardown=on`` enables asynchronous teardown. A new process called
|
||||
|
@ -5013,6 +5016,10 @@ SRST
|
|||
``chroot=dir`` can be used for doing a chroot to the specified directory
|
||||
immediately before starting the guest execution. This is especially useful
|
||||
in combination with -runas.
|
||||
|
||||
``user=username`` or ``user=uid:gid`` can be used to drop root privileges
|
||||
by switching to the specified user (via username) or user and group
|
||||
(via uid:gid) immediately before starting guest execution.
|
||||
ERST
|
||||
#endif
|
||||
|
||||
|
|
15
system/vl.c
15
system/vl.c
|
@ -773,6 +773,10 @@ static QemuOptsList qemu_run_with_opts = {
|
|||
.name = "chroot",
|
||||
.type = QEMU_OPT_STRING,
|
||||
},
|
||||
{
|
||||
.name = "user",
|
||||
.type = QEMU_OPT_STRING,
|
||||
},
|
||||
{ /* end of list */ }
|
||||
},
|
||||
};
|
||||
|
@ -3586,6 +3590,7 @@ void qemu_init(int argc, char **argv)
|
|||
break;
|
||||
#if defined(CONFIG_POSIX)
|
||||
case QEMU_OPTION_runas:
|
||||
warn_report("-runas is deprecated, use '-run-with user=...' instead");
|
||||
if (!os_set_runas(optarg)) {
|
||||
error_report("User \"%s\" doesn't exist"
|
||||
" (and is not <uid>:<gid>)",
|
||||
|
@ -3612,6 +3617,16 @@ void qemu_init(int argc, char **argv)
|
|||
if (str) {
|
||||
os_set_chroot(str);
|
||||
}
|
||||
str = qemu_opt_get(opts, "user");
|
||||
if (str) {
|
||||
if (!os_set_runas(str)) {
|
||||
error_report("User \"%s\" doesn't exist"
|
||||
" (and is not <uid>:<gid>)",
|
||||
optarg);
|
||||
exit(1);
|
||||
}
|
||||
}
|
||||
|
||||
break;
|
||||
}
|
||||
#endif /* CONFIG_POSIX */
|
||||
|
|
Loading…
Reference in New Issue