From 5ac067a24a85fec57d2d87b2d12ae4ffa6aa2d9e Mon Sep 17 00:00:00 2001 From: Ian Jackson Date: Thu, 8 Mar 2018 18:07:26 +0000 Subject: [PATCH 01/16] checkpatch: Add xendevicemodel_handle to the list of types This avoids checkpatch misparsing (as statements) long function definitions or declarations, which sometimes start with constructs like this: static inline int xendevicemodel_relocate_memory( xendevicemodel_handle *dmod, domid_t domid, ... The type xendevicemodel_handle does not conform to Qemu CODING_STYLE, which would suggest CamelCase. However, it is a type defined by the Xen Project in xen.git. It would be possible to introduce a typedef to allow the qemu code to refer to it by a differently-spelled name, but that would obfuscate more than it would clarify. CC: Eric Blake CC: Paolo Bonzini CC: Daniel P. Berrange Signed-off-by: Ian Jackson Reviewed-by: Eric Blake --- scripts/checkpatch.pl | 1 + 1 file changed, 1 insertion(+) diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl index d52207a3cc..5b8735defb 100755 --- a/scripts/checkpatch.pl +++ b/scripts/checkpatch.pl @@ -266,6 +266,7 @@ our @typeList = ( qr{target_(?:u)?long}, qr{hwaddr}, qr{xml${Ident}}, + qr{xendevicemodel_handle}, ); # This can be modified by sub possible. Since it can be empty, be careful From 7a64c17f3b3015bf741593a019538275c764455f Mon Sep 17 00:00:00 2001 From: Ian Jackson Date: Fri, 9 Mar 2018 12:02:50 +0000 Subject: [PATCH 02/16] AccelClass: Introduce accel_setup_post This is called just before os_setup_post. Currently none of the accelerators provide this hook, but the Xen one is going to provide one in a moment. Signed-off-by: Ian Jackson Reviewed-by: Eduardo Habkost --- accel/accel.c | 9 +++++++++ include/sysemu/accel.h | 3 +++ vl.c | 1 + 3 files changed, 13 insertions(+) diff --git a/accel/accel.c b/accel/accel.c index 93e2434c87..9cfab115d0 100644 --- a/accel/accel.c +++ b/accel/accel.c @@ -126,6 +126,15 @@ void accel_register_compat_props(AccelState *accel) register_compat_props_array(class->global_props); } +void accel_setup_post(MachineState *ms) +{ + AccelState *accel = ms->accelerator; + AccelClass *acc = ACCEL_GET_CLASS(accel); + if (acc->setup_post) { + acc->setup_post(ms, accel); + } +} + static void register_accel_types(void) { type_register_static(&accel_type); diff --git a/include/sysemu/accel.h b/include/sysemu/accel.h index 5a632cee1d..637358f430 100644 --- a/include/sysemu/accel.h +++ b/include/sysemu/accel.h @@ -40,6 +40,7 @@ typedef struct AccelClass { const char *name; int (*available)(void); int (*init_machine)(MachineState *ms); + void (*setup_post)(MachineState *ms, AccelState *accel); bool *allowed; /* * Array of global properties that would be applied when specific @@ -68,5 +69,7 @@ extern unsigned long tcg_tb_size; void configure_accelerator(MachineState *ms); /* Register accelerator specific global properties */ void accel_register_compat_props(AccelState *accel); +/* Called just before os_setup_post (ie just before drop OS privs) */ +void accel_setup_post(MachineState *ms); #endif diff --git a/vl.c b/vl.c index 616956adf1..d37e8576d6 100644 --- a/vl.c +++ b/vl.c @@ -4742,6 +4742,7 @@ int main(int argc, char **argv, char **envp) vm_start(); } + accel_setup_post(current_machine); os_setup_post(); main_loop(); From 58ea9a7a025243d3c34f869d4c5ea7c174235c4e Mon Sep 17 00:00:00 2001 From: Anthony PERARD Date: Mon, 25 Sep 2017 16:01:48 +0100 Subject: [PATCH 03/16] xen: link against xentoolcore Xen libraries in 4.10 include a new xentoolcore library. This contains the xentoolcore_restrict_all function which we are about to want to use. Signed-off-by: Ian Jackson Acked-by: Stefano Stabellini --- configure | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/configure b/configure index 0a19b033bc..5cf9dde235 100755 --- a/configure +++ b/configure @@ -2189,6 +2189,9 @@ if test "$xen" != "no" ; then xen=yes xen_pc="xencontrol xenstore xenguest xenforeignmemory xengnttab" xen_pc="$xen_pc xenevtchn xendevicemodel" + if $pkg_config --exists xentoolcore; then + xen_pc="$xen_pc xentoolcore" + fi QEMU_CFLAGS="$QEMU_CFLAGS $($pkg_config --cflags $xen_pc)" libs_softmmu="$($pkg_config --libs $xen_pc) $libs_softmmu" LDFLAGS="$($pkg_config --libs $xen_pc) $LDFLAGS" @@ -2220,18 +2223,20 @@ EOF cat > $TMPC < +#include int main(void) { xenforeignmemory_handle *xfmem; xfmem = xenforeignmemory_open(0, 0); xenforeignmemory_map2(xfmem, 0, 0, 0, 0, 0, 0, 0); + xentoolcore_restrict_all(0); return 0; } EOF - compile_prog "" "$xen_libs -lxendevicemodel $xen_stable_libs" + compile_prog "" "$xen_libs -lxendevicemodel $xen_stable_libs -lxentoolcore" then - xen_stable_libs="-lxendevicemodel $xen_stable_libs" + xen_stable_libs="-lxendevicemodel $xen_stable_libs -lxentoolcore" xen_ctrl_version=41000 xen=yes elif From 0ef4d87da58dfe0e0e466414701c103b7a44df65 Mon Sep 17 00:00:00 2001 From: Ian Jackson Date: Fri, 15 Sep 2017 16:03:14 +0100 Subject: [PATCH 04/16] xen: restrict: use xentoolcore_restrict_all And insist that it works. Drop individual use of xendevicemodel_restrict and xenforeignmemory_restrict. These are not actually effective in this version of qemu, because qemu has a large number of fds open onto various Xen control devices. The restriction arrangements are still not right, because the restriction needs to be done very late - after qemu has opened all of its control fds. xentoolcore_restrict_all and xentoolcore.h are available in Xen 4.10 and later, only. Provide a compatibility stub. And drop the compatibility stubs for the old functions. Signed-off-by: Ian Jackson Reviewed-by: Anthony PERARD Acked-by: Stefano Stabellini --- include/hw/xen/xen_common.h | 46 +++++++++---------------------------- 1 file changed, 11 insertions(+), 35 deletions(-) diff --git a/include/hw/xen/xen_common.h b/include/hw/xen/xen_common.h index 64a978e4e0..1766bb9fb5 100644 --- a/include/hw/xen/xen_common.h +++ b/include/hw/xen/xen_common.h @@ -91,6 +91,16 @@ static inline void *xenforeignmemory_map2(xenforeignmemory_handle *h, return xenforeignmemory_map(h, dom, prot, pages, arr, err); } +static inline int xentoolcore_restrict_all(domid_t domid) +{ + errno = ENOTTY; + return -1; +} + +#else /* CONFIG_XEN_CTRL_INTERFACE_VERSION >= 41000 */ + +#include + #endif #if CONFIG_XEN_CTRL_INTERFACE_VERSION < 40900 @@ -218,20 +228,6 @@ static inline int xendevicemodel_set_mem_type( return xc_hvm_set_mem_type(dmod, domid, mem_type, first_pfn, nr); } -static inline int xendevicemodel_restrict( - xendevicemodel_handle *dmod, domid_t domid) -{ - errno = ENOTTY; - return -1; -} - -static inline int xenforeignmemory_restrict( - xenforeignmemory_handle *fmem, domid_t domid) -{ - errno = ENOTTY; - return -1; -} - #else /* CONFIG_XEN_CTRL_INTERFACE_VERSION >= 40900 */ #undef XC_WANT_COMPAT_DEVICEMODEL_API @@ -290,28 +286,8 @@ static inline int xen_modified_memory(domid_t domid, uint64_t first_pfn, static inline int xen_restrict(domid_t domid) { int rc; - - /* Attempt to restrict devicemodel operations */ - rc = xendevicemodel_restrict(xen_dmod, domid); + rc = xentoolcore_restrict_all(domid); trace_xen_domid_restrict(rc ? errno : 0); - - if (rc < 0) { - /* - * If errno is ENOTTY then restriction is not implemented so - * there's no point in trying to restrict other types of - * operation, but it should not be treated as a failure. - */ - if (errno == ENOTTY) { - return 0; - } - - return rc; - } - - /* Restrict foreignmemory operations */ - rc = xenforeignmemory_restrict(xen_fmem, domid); - trace_xen_domid_restrict(rc ? errno : 0); - return rc; } From 4564e63f80ace744093157782c3db45fc50a4836 Mon Sep 17 00:00:00 2001 From: Ian Jackson Date: Fri, 15 Sep 2017 16:02:24 +0100 Subject: [PATCH 05/16] xen: defer call to xen_restrict until just before os_setup_post We need to restrict *all* the control fds that qemu opens. Looking in /proc/PID/fd shows there are many; their allocation seems scattered throughout Xen support code in qemu. We must postpone the restrict call until roughly the same time as qemu changes its uid, chroots (if applicable), and so on. There doesn't seem to be an appropriate hook already. The RunState change hook fires at different times depending on exactly what mode qemu is operating in. And it appears that no-one but the Xen code wants a hook at this phase of execution. So, introduce a bare call to a new function xen_setup_post, just before os_setup_post. Also provide the appropriate stub for when Xen compilation is disabled. We do the restriction before rather than after os_setup_post, because xen_restrict may need to open /dev/null, and os_setup_post might have called chroot. Currently this does not work with migration, because when running as the Xen device model qemu needs to signal to the toolstack that it is ready. It currently does this using xenstore, and for incoming migration (but not for ordinary startup) that happens after os_setup_post. It is correct that this happens late: we want the incoming migration stream to be processed by a restricted qemu. The fix for this will be to do the startup notification a different way, without using xenstore. (QMP is probably a reasonable choice.) So for now this restriction feature cannot be used in conjunction with migration. (Note that this is not a regression in this patch, because previously the -xen-restrict-domid call was, in fact, simply ineffective!) We will revisit this in the Xen 4.11 release cycle. Signed-off-by: Ian Jackson CC: Paolo Bonzini (maintainer:X86) CC: Richard Henderson (maintainer:X86) CC: Eduardo Habkost (maintainer:X86) CC: Michael S. Tsirkin (supporter:PC) Acked-by: Anthony PERARD --- hw/i386/xen/xen-hvm.c | 8 -------- hw/xen/xen-common.c | 14 ++++++++++++++ 2 files changed, 14 insertions(+), 8 deletions(-) diff --git a/hw/i386/xen/xen-hvm.c b/hw/i386/xen/xen-hvm.c index f24b7d4923..9c3b6b312e 100644 --- a/hw/i386/xen/xen-hvm.c +++ b/hw/i386/xen/xen-hvm.c @@ -1254,14 +1254,6 @@ void xen_hvm_init(PCMachineState *pcms, MemoryRegion **ram_memory) goto err; } - if (xen_domid_restrict) { - rc = xen_restrict(xen_domid); - if (rc < 0) { - error_report("failed to restrict: error %d", errno); - goto err; - } - } - xen_create_ioreq_server(xen_domid, &state->ioservid); state->exit.notify = xen_exit_notifier; diff --git a/hw/xen/xen-common.c b/hw/xen/xen-common.c index 83099dd1b1..454777c587 100644 --- a/hw/xen/xen-common.c +++ b/hw/xen/xen-common.c @@ -117,6 +117,19 @@ static void xen_change_state_handler(void *opaque, int running, } } +static void xen_setup_post(MachineState *ms, AccelState *accel) +{ + int rc; + + if (xen_domid_restrict) { + rc = xen_restrict(xen_domid); + if (rc < 0) { + perror("xen: failed to restrict"); + exit(1); + } + } +} + static int xen_init(MachineState *ms) { xen_xc = xc_interface_open(0, 0, 0); @@ -165,6 +178,7 @@ static void xen_accel_class_init(ObjectClass *oc, void *data) AccelClass *ac = ACCEL_CLASS(oc); ac->name = "Xen"; ac->init_machine = xen_init; + ac->setup_post = xen_setup_post; ac->allowed = &xen_allowed; ac->global_props = xen_compat_props; } From 74aae6bff4fec3a655a2da7053ac2edbaf51e7b6 Mon Sep 17 00:00:00 2001 From: Ian Jackson Date: Fri, 15 Sep 2017 17:50:47 +0100 Subject: [PATCH 06/16] xen: destroy_hvm_domain: Move reason into a variable We are going to want to reuse this. No functional change. Signed-off-by: Ian Jackson Reviewed-by: Anthony PERARD Acked-by: Stefano Stabellini --- hw/i386/xen/xen-hvm.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/hw/i386/xen/xen-hvm.c b/hw/i386/xen/xen-hvm.c index 9c3b6b312e..3590d99934 100644 --- a/hw/i386/xen/xen-hvm.c +++ b/hw/i386/xen/xen-hvm.c @@ -1387,12 +1387,13 @@ void destroy_hvm_domain(bool reboot) xc_interface *xc_handle; int sts; + unsigned int reason = reboot ? SHUTDOWN_reboot : SHUTDOWN_poweroff; + xc_handle = xc_interface_open(0, 0, 0); if (xc_handle == NULL) { fprintf(stderr, "Cannot acquire xenctrl handle\n"); } else { - sts = xc_domain_shutdown(xc_handle, xen_domid, - reboot ? SHUTDOWN_reboot : SHUTDOWN_poweroff); + sts = xc_domain_shutdown(xc_handle, xen_domid, reason); if (sts != 0) { fprintf(stderr, "xc_domain_shutdown failed to issue %s, " "sts %d, %s\n", reboot ? "reboot" : "poweroff", From 85f3c64da3235ae9f7c66a5264170f5101145b30 Mon Sep 17 00:00:00 2001 From: Ian Jackson Date: Tue, 3 Oct 2017 18:51:05 +0100 Subject: [PATCH 07/16] xen: move xc_interface compatibility fallback further up the file We are going to want to use the dummy xendevicemodel_handle type in new stub functions in the CONFIG_XEN_CTRL_INTERFACE_VERSION < 41000 section. So we need to provide that definition, or (as applicable) include the appropriate header, earlier in the file. (Ideally the newer compatibility layers would be at the bottom of the file, so that they can naturally benefit from the compatibility layers for earlier version. But that's rather too much for this series.) No functional change. Signed-off-by: Ian Jackson Acked-by: Anthony PERARD Acked-by: Stefano Stabellini --- include/hw/xen/xen_common.h | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) diff --git a/include/hw/xen/xen_common.h b/include/hw/xen/xen_common.h index 1766bb9fb5..60c4ebb6cb 100644 --- a/include/hw/xen/xen_common.h +++ b/include/hw/xen/xen_common.h @@ -78,6 +78,17 @@ static inline void *xenforeignmemory_map(xc_interface *h, uint32_t dom, extern xenforeignmemory_handle *xen_fmem; +#if CONFIG_XEN_CTRL_INTERFACE_VERSION < 40900 + +typedef xc_interface xendevicemodel_handle; + +#else /* CONFIG_XEN_CTRL_INTERFACE_VERSION >= 40900 */ + +#undef XC_WANT_COMPAT_DEVICEMODEL_API +#include + +#endif + #if CONFIG_XEN_CTRL_INTERFACE_VERSION < 41000 #define XEN_COMPAT_PHYSMAP @@ -105,8 +116,6 @@ static inline int xentoolcore_restrict_all(domid_t domid) #if CONFIG_XEN_CTRL_INTERFACE_VERSION < 40900 -typedef xc_interface xendevicemodel_handle; - static inline xendevicemodel_handle *xendevicemodel_open( struct xentoollog_logger *logger, unsigned int open_flags) { @@ -228,11 +237,6 @@ static inline int xendevicemodel_set_mem_type( return xc_hvm_set_mem_type(dmod, domid, mem_type, first_pfn, nr); } -#else /* CONFIG_XEN_CTRL_INTERFACE_VERSION >= 40900 */ - -#undef XC_WANT_COMPAT_DEVICEMODEL_API -#include - #endif extern xendevicemodel_handle *xen_dmod; From 6b47c2aa780c98cea7a39cbe36c30d3923e5163e Mon Sep 17 00:00:00 2001 From: Ian Jackson Date: Fri, 15 Sep 2017 17:51:52 +0100 Subject: [PATCH 08/16] xen: destroy_hvm_domain: Try xendevicemodel_shutdown xc_interface_open etc. is not going to work if we have dropped privilege, but xendevicemodel_shutdown will if everything is new enough. xendevicemodel_shutdown is only availabe in Xen 4.10 and later, so provide a stub for earlier versions. Signed-off-by: Ian Jackson Reviewed-by: Anthony PERARD --- hw/i386/xen/xen-hvm.c | 12 ++++++++++++ include/hw/xen/xen_common.h | 7 +++++++ 2 files changed, 19 insertions(+) diff --git a/hw/i386/xen/xen-hvm.c b/hw/i386/xen/xen-hvm.c index 3590d99934..fb727bc6c2 100644 --- a/hw/i386/xen/xen-hvm.c +++ b/hw/i386/xen/xen-hvm.c @@ -1386,9 +1386,21 @@ void destroy_hvm_domain(bool reboot) { xc_interface *xc_handle; int sts; + int rc; unsigned int reason = reboot ? SHUTDOWN_reboot : SHUTDOWN_poweroff; + if (xen_dmod) { + rc = xendevicemodel_shutdown(xen_dmod, xen_domid, reason); + if (!rc) { + return; + } + if (errno != ENOTTY /* old Xen */) { + perror("xendevicemodel_shutdown failed"); + } + /* well, try the old thing then */ + } + xc_handle = xc_interface_open(0, 0, 0); if (xc_handle == NULL) { fprintf(stderr, "Cannot acquire xenctrl handle\n"); diff --git a/include/hw/xen/xen_common.h b/include/hw/xen/xen_common.h index 60c4ebb6cb..4bd30a386b 100644 --- a/include/hw/xen/xen_common.h +++ b/include/hw/xen/xen_common.h @@ -108,6 +108,13 @@ static inline int xentoolcore_restrict_all(domid_t domid) return -1; } +static inline int xendevicemodel_shutdown(xendevicemodel_handle *dmod, + domid_t domid, unsigned int reason) +{ + errno = ENOTTY; + return -1; +} + #else /* CONFIG_XEN_CTRL_INTERFACE_VERSION >= 41000 */ #include From f0a2171bf9f35b0430e18676a688b2c985f8917a Mon Sep 17 00:00:00 2001 From: Ian Jackson Date: Mon, 16 Apr 2018 15:08:03 +0100 Subject: [PATCH 09/16] os-posix: cleanup: Replace fprintfs with error_report in change_process_uid I'm going to be editing this function and it makes sense to clean up this style problem in advance. Signed-off-by: Ian Jackson CC: Paolo Bonzini CC: Markus Armbruster CC: Daniel P. Berrange CC: Michael Tokarev Reviewed-by: Peter Maydell Reviewed-by: Thomas Huth --- os-posix.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/os-posix.c b/os-posix.c index b9c2343b1e..560db955cb 100644 --- a/os-posix.c +++ b/os-posix.c @@ -167,20 +167,20 @@ static void change_process_uid(void) { if (user_pwd) { if (setgid(user_pwd->pw_gid) < 0) { - fprintf(stderr, "Failed to setgid(%d)\n", user_pwd->pw_gid); + error_report("Failed to setgid(%d)", user_pwd->pw_gid); exit(1); } if (initgroups(user_pwd->pw_name, user_pwd->pw_gid) < 0) { - fprintf(stderr, "Failed to initgroups(\"%s\", %d)\n", - user_pwd->pw_name, user_pwd->pw_gid); + error_report("Failed to initgroups(\"%s\", %d)", + user_pwd->pw_name, user_pwd->pw_gid); exit(1); } if (setuid(user_pwd->pw_uid) < 0) { - fprintf(stderr, "Failed to setuid(%d)\n", user_pwd->pw_uid); + error_report("Failed to setuid(%d)", user_pwd->pw_uid); exit(1); } if (setuid(0) != -1) { - fprintf(stderr, "Dropping privileges failed\n"); + error_report("Dropping privileges failed"); exit(1); } } From 2c42f1e80103cb926c0703d4c1ac1fb9c3e2c600 Mon Sep 17 00:00:00 2001 From: Ian Jackson Date: Fri, 15 Sep 2017 18:10:44 +0100 Subject: [PATCH 10/16] os-posix: Provide new -runas : facility This allows the caller to specify a uid and gid to use, even if there is no corresponding password entry. This will be useful in certain Xen configurations. We don't support just -runas because: (i) deprivileging without calling setgroups would be ineffective (ii) given only a uid we don't know what gid we ought to use (since uids may eppear in multiple passwd file entries with different gids). Signed-off-by: Ian Jackson Reviewed-by: Anthony PERARD CC: Paolo Bonzini CC: Markus Armbruster CC: Daniel P. Berrange CC: Michael Tokarev Reviewed-by: Markus Armbruster --- os-posix.c | 77 +++++++++++++++++++++++++++++++++++++++++-------- qemu-options.hx | 3 +- 2 files changed, 67 insertions(+), 13 deletions(-) diff --git a/os-posix.c b/os-posix.c index 560db955cb..0f59566639 100644 --- a/os-posix.c +++ b/os-posix.c @@ -41,7 +41,14 @@ #include #endif -static struct passwd *user_pwd; +/* + * Must set all three of these at once. + * Legal combinations are unset by name by uid + */ +static struct passwd *user_pwd; /* NULL non-NULL NULL */ +static uid_t user_uid = (uid_t)-1; /* -1 -1 >=0 */ +static gid_t user_gid = (gid_t)-1; /* -1 -1 >=0 */ + static const char *chroot_dir; static int daemonize; static int daemon_pipe; @@ -127,6 +134,33 @@ void os_set_proc_name(const char *s) #endif } + +static bool os_parse_runas_uid_gid(const char *optarg) +{ + unsigned long lv; + const char *ep; + uid_t got_uid; + gid_t got_gid; + int rc; + + rc = qemu_strtoul(optarg, &ep, 0, &lv); + got_uid = lv; /* overflow here is ID in C99 */ + if (rc || *ep != ':' || got_uid != lv || got_uid == (uid_t)-1) { + return false; + } + + rc = qemu_strtoul(ep + 1, 0, 0, &lv); + got_gid = lv; /* overflow here is ID in C99 */ + if (rc || got_gid != lv || got_gid == (gid_t)-1) { + return false; + } + + user_pwd = NULL; + user_uid = got_uid; + user_gid = got_gid; + return true; +} + /* * Parse OS specific command line options. * return 0 if option handled, -1 otherwise @@ -144,8 +178,13 @@ void os_parse_cmd_args(int index, const char *optarg) #endif case QEMU_OPTION_runas: user_pwd = getpwnam(optarg); - if (!user_pwd) { - fprintf(stderr, "User \"%s\" doesn't exist\n", optarg); + if (user_pwd) { + user_uid = -1; + user_gid = -1; + } else if (!os_parse_runas_uid_gid(optarg)) { + error_report("User \"%s\" doesn't exist" + " (and is not :)", + optarg); exit(1); } break; @@ -165,18 +204,32 @@ void os_parse_cmd_args(int index, const char *optarg) static void change_process_uid(void) { - if (user_pwd) { - if (setgid(user_pwd->pw_gid) < 0) { - error_report("Failed to setgid(%d)", user_pwd->pw_gid); + assert((user_uid == (uid_t)-1) || user_pwd == NULL); + assert((user_uid == (uid_t)-1) == + (user_gid == (gid_t)-1)); + + if (user_pwd || user_uid != (uid_t)-1) { + gid_t intended_gid = user_pwd ? user_pwd->pw_gid : user_gid; + uid_t intended_uid = user_pwd ? user_pwd->pw_uid : user_uid; + if (setgid(intended_gid) < 0) { + error_report("Failed to setgid(%d)", intended_gid); exit(1); } - if (initgroups(user_pwd->pw_name, user_pwd->pw_gid) < 0) { - error_report("Failed to initgroups(\"%s\", %d)", - user_pwd->pw_name, user_pwd->pw_gid); - exit(1); + if (user_pwd) { + if (initgroups(user_pwd->pw_name, user_pwd->pw_gid) < 0) { + error_report("Failed to initgroups(\"%s\", %d)", + user_pwd->pw_name, user_pwd->pw_gid); + exit(1); + } + } else { + if (setgroups(1, &user_gid) < 0) { + error_report("Failed to setgroups(1, [%d])", + user_gid); + exit(1); + } } - if (setuid(user_pwd->pw_uid) < 0) { - error_report("Failed to setuid(%d)", user_pwd->pw_uid); + if (setuid(intended_uid) < 0) { + error_report("Failed to setuid(%d)", intended_uid); exit(1); } if (setuid(0) != -1) { diff --git a/qemu-options.hx b/qemu-options.hx index ca4e412f2f..5fbf966292 100644 --- a/qemu-options.hx +++ b/qemu-options.hx @@ -3765,7 +3765,8 @@ ETEXI #ifndef _WIN32 DEF("runas", HAS_ARG, QEMU_OPTION_runas, \ - "-runas user change to user id user just before starting the VM\n", + "-runas user change to user id user just before starting the VM\n" \ + " user can be numeric uid:gid instead\n", QEMU_ARCH_ALL) #endif STEXI From 2cbf8903530b936964dd3af7e2e5bf85c3955d5c Mon Sep 17 00:00:00 2001 From: Ross Lagerwall Date: Mon, 23 Oct 2017 10:27:27 +0100 Subject: [PATCH 11/16] xen: Use newly added dmops for mapping VGA memory Xen unstable (to be in 4.11) has two new dmops, relocate_memory and pin_memory_cacheattr. Use these to set up the VGA memory, replacing the previous calls to libxc. This allows the VGA console to work properly when QEMU is running restricted (-xen-domid-restrict). Wrapper functions are provided to allow QEMU to work with older versions of Xen. Tweak the error handling while making this change: * Report pin_memory_cacheattr errors. * Report errors even when DEBUG_HVM is not set. This is useful for trying to understand why VGA is not working, since otherwise it just fails silently. * Fix the return values when an error occurs. The functions now consistently return -1 and set errno. CC: Ian Jackson Signed-off-by: Ross Lagerwall Reviewed-by: Ian Jackson Signed-off-by: Ian Jackson Acked-by: Anthony PERARD --- configure | 19 +++++++++++++++ hw/i386/xen/xen-hvm.c | 46 ++++++++++++++++++++----------------- include/hw/xen/xen_common.h | 32 ++++++++++++++++++++++++++ 3 files changed, 76 insertions(+), 21 deletions(-) diff --git a/configure b/configure index 5cf9dde235..aa35aef14b 100755 --- a/configure +++ b/configure @@ -2221,6 +2221,25 @@ EOF # Xen unstable elif cat > $TMPC < +int main(void) { + xendevicemodel_handle *xd; + + xd = xendevicemodel_open(0, 0); + xendevicemodel_pin_memory_cacheattr(xd, 0, 0, 0, 0); + + return 0; +} +EOF + compile_prog "" "$xen_libs -lxendevicemodel $xen_stable_libs -lxentoolcore" + then + xen_stable_libs="-lxendevicemodel $xen_stable_libs -lxentoolcore" + xen_ctrl_version=41100 + xen=yes + elif + cat > $TMPC < #include diff --git a/hw/i386/xen/xen-hvm.c b/hw/i386/xen/xen-hvm.c index fb727bc6c2..caa563be3d 100644 --- a/hw/i386/xen/xen-hvm.c +++ b/hw/i386/xen/xen-hvm.c @@ -347,7 +347,7 @@ static int xen_add_to_physmap(XenIOState *state, MemoryRegion *mr, hwaddr offset_within_region) { - unsigned long i = 0; + unsigned long nr_pages; int rc = 0; XenPhysmap *physmap = NULL; hwaddr pfn, start_gpfn; @@ -396,22 +396,26 @@ go_physmap: pfn = phys_offset >> TARGET_PAGE_BITS; start_gpfn = start_addr >> TARGET_PAGE_BITS; - for (i = 0; i < size >> TARGET_PAGE_BITS; i++) { - unsigned long idx = pfn + i; - xen_pfn_t gpfn = start_gpfn + i; + nr_pages = size >> TARGET_PAGE_BITS; + rc = xendevicemodel_relocate_memory(xen_dmod, xen_domid, nr_pages, pfn, + start_gpfn); + if (rc) { + int saved_errno = errno; - rc = xen_xc_domain_add_to_physmap(xen_xc, xen_domid, XENMAPSPACE_gmfn, idx, gpfn); - if (rc) { - DPRINTF("add_to_physmap MFN %"PRI_xen_pfn" to PFN %" - PRI_xen_pfn" failed: %d (errno: %d)\n", idx, gpfn, rc, errno); - return -rc; - } + error_report("relocate_memory %lu pages from GFN %"HWADDR_PRIx + " to GFN %"HWADDR_PRIx" failed: %s", + nr_pages, pfn, start_gpfn, strerror(saved_errno)); + errno = saved_errno; + return -1; } - xc_domain_pin_memory_cacheattr(xen_xc, xen_domid, + rc = xendevicemodel_pin_memory_cacheattr(xen_dmod, xen_domid, start_addr >> TARGET_PAGE_BITS, (start_addr + size - 1) >> TARGET_PAGE_BITS, XEN_DOMCTL_MEM_CACHEATTR_WB); + if (rc) { + error_report("pin_memory_cacheattr failed: %s", strerror(errno)); + } return xen_save_physmap(state, physmap); } @@ -419,7 +423,6 @@ static int xen_remove_from_physmap(XenIOState *state, hwaddr start_addr, ram_addr_t size) { - unsigned long i = 0; int rc = 0; XenPhysmap *physmap = NULL; hwaddr phys_offset = 0; @@ -438,16 +441,17 @@ static int xen_remove_from_physmap(XenIOState *state, size >>= TARGET_PAGE_BITS; start_addr >>= TARGET_PAGE_BITS; phys_offset >>= TARGET_PAGE_BITS; - for (i = 0; i < size; i++) { - xen_pfn_t idx = start_addr + i; - xen_pfn_t gpfn = phys_offset + i; + rc = xendevicemodel_relocate_memory(xen_dmod, xen_domid, size, start_addr, + phys_offset); + if (rc) { + int saved_errno = errno; - rc = xen_xc_domain_add_to_physmap(xen_xc, xen_domid, XENMAPSPACE_gmfn, idx, gpfn); - if (rc) { - fprintf(stderr, "add_to_physmap MFN %"PRI_xen_pfn" to PFN %" - PRI_xen_pfn" failed: %d (errno: %d)\n", idx, gpfn, rc, errno); - return -rc; - } + error_report("relocate_memory "RAM_ADDR_FMT" pages" + " from GFN %"HWADDR_PRIx + " to GFN %"HWADDR_PRIx" failed: %s", + size, start_addr, phys_offset, strerror(saved_errno)); + errno = saved_errno; + return -1; } QLIST_REMOVE(physmap, list); diff --git a/include/hw/xen/xen_common.h b/include/hw/xen/xen_common.h index 4bd30a386b..2eed6fcba3 100644 --- a/include/hw/xen/xen_common.h +++ b/include/hw/xen/xen_common.h @@ -89,6 +89,38 @@ typedef xc_interface xendevicemodel_handle; #endif +#if CONFIG_XEN_CTRL_INTERFACE_VERSION < 41100 + +static inline int xendevicemodel_relocate_memory( + xendevicemodel_handle *dmod, domid_t domid, uint32_t size, uint64_t src_gfn, + uint64_t dst_gfn) +{ + uint32_t i; + int rc; + + for (i = 0; i < size; i++) { + unsigned long idx = src_gfn + i; + xen_pfn_t gpfn = dst_gfn + i; + + rc = xc_domain_add_to_physmap(xen_xc, domid, XENMAPSPACE_gmfn, idx, + gpfn); + if (rc) { + return rc; + } + } + + return 0; +} + +static inline int xendevicemodel_pin_memory_cacheattr( + xendevicemodel_handle *dmod, domid_t domid, uint64_t start, uint64_t end, + uint32_t type) +{ + return xc_domain_pin_memory_cacheattr(xen_xc, domid, start, end, type); +} + +#endif /* CONFIG_XEN_CTRL_INTERFACE_VERSION < 41100 */ + #if CONFIG_XEN_CTRL_INTERFACE_VERSION < 41000 #define XEN_COMPAT_PHYSMAP From 1c4010fa09971bcb8c696aa1df350263a2bd0298 Mon Sep 17 00:00:00 2001 From: Ian Jackson Date: Fri, 9 Mar 2018 16:08:55 +0000 Subject: [PATCH 12/16] xen: Remove now-obsolete xen_xc_domain_add_to_physmap The last user was just removed; remove this function, accordingly. Signed-off-by: Ian Jackson Acked-by: Anthony PERARD --- include/hw/xen/xen_common.h | 22 ---------------------- 1 file changed, 22 deletions(-) diff --git a/include/hw/xen/xen_common.h b/include/hw/xen/xen_common.h index 2eed6fcba3..5f1402b494 100644 --- a/include/hw/xen/xen_common.h +++ b/include/hw/xen/xen_common.h @@ -645,28 +645,6 @@ static inline int xen_set_ioreq_server_state(domid_t dom, #endif -#if CONFIG_XEN_CTRL_INTERFACE_VERSION < 40600 -static inline int xen_xc_domain_add_to_physmap(xc_interface *xch, uint32_t domid, - unsigned int space, - unsigned long idx, - xen_pfn_t gpfn) -{ - return xc_domain_add_to_physmap(xch, domid, space, idx, gpfn); -} -#else -static inline int xen_xc_domain_add_to_physmap(xc_interface *xch, uint32_t domid, - unsigned int space, - unsigned long idx, - xen_pfn_t gpfn) -{ - /* In Xen 4.6 rc is -1 and errno contains the error value. */ - int rc = xc_domain_add_to_physmap(xch, domid, space, idx, gpfn); - if (rc == -1) - return errno; - return rc; -} -#endif - #ifdef CONFIG_XEN_PV_DOMAIN_BUILD #if CONFIG_XEN_CTRL_INTERFACE_VERSION < 40700 static inline int xen_domain_create(xc_interface *xc, uint32_t ssidref, From 4473348adf6640ca12b95bc29d1b06796994afb2 Mon Sep 17 00:00:00 2001 From: Ross Lagerwall Date: Mon, 5 Mar 2018 10:07:46 +0000 Subject: [PATCH 13/16] xen: Expect xenstore write to fail when restricted Saving the current state to xenstore may fail when running restricted (in particular, after a migration). Therefore, don't report the error or exit when running restricted. Toolstacks that want to allow running QEMU restricted should instead make use of QMP events to listen for state changes. CC: Ian Jackson Signed-off-by: Ross Lagerwall Reviewed-by: Ian Jackson Acked-by: Anthony PERARD --- hw/xen/xen-common.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/hw/xen/xen-common.c b/hw/xen/xen-common.c index 454777c587..6ec14c73ca 100644 --- a/hw/xen/xen-common.c +++ b/hw/xen/xen-common.c @@ -101,7 +101,12 @@ static void xenstore_record_dm_state(struct xs_handle *xs, const char *state) } snprintf(path, sizeof (path), "device-model/%u/state", xen_domid); - if (!xs_write(xs, XBT_NULL, path, state, strlen(state))) { + /* + * This call may fail when running restricted so don't make it fatal in + * that case. Toolstacks should instead use QMP to listen for state changes. + */ + if (!xs_write(xs, XBT_NULL, path, state, strlen(state)) && + !xen_domid_restrict) { error_report("error recording dm state"); exit(1); } From 22cd4f4835b2053271e737b1679927b9b8aa4252 Mon Sep 17 00:00:00 2001 From: Ian Jackson Date: Mon, 16 Apr 2018 15:15:51 +0100 Subject: [PATCH 14/16] os-posix: cleanup: Replace fprintf with error_report in remaining call sites MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Ian Jackson CC: Paolo Bonzini CC: Markus Armbruster CC: Daniel P. Berrange CC: Michael Tokarev Reviewed-by: Philippe Mathieu-Daudé Reviewed-by: Thomas Huth --- os-posix.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/os-posix.c b/os-posix.c index 0f59566639..a2ba50d23f 100644 --- a/os-posix.c +++ b/os-posix.c @@ -129,7 +129,7 @@ void os_set_proc_name(const char *s) exit(1); } #else - fprintf(stderr, "Change of process name not supported by your OS\n"); + error_report("Change of process name not supported by your OS"); exit(1); #endif } @@ -243,7 +243,7 @@ static void change_root(void) { if (chroot_dir) { if (chroot(chroot_dir) < 0) { - fprintf(stderr, "chroot failed\n"); + error_report("chroot failed"); exit(1); } if (chdir("/")) { From a7aaec148e27193cc6f7d33d2f18f81eed011a5c Mon Sep 17 00:00:00 2001 From: Ian Jackson Date: Mon, 16 Apr 2018 15:16:23 +0100 Subject: [PATCH 15/16] os-posix: cleanup: Replace perror with error_report MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit perror() is defined to fprintf(stderr,...). HACKING says fprintf(stderr,...) is wrong. So perror() is too. Signed-off-by: Ian Jackson CC: Paolo Bonzini CC: Markus Armbruster CC: Daniel P. Berrange CC: Michael Tokarev CC: Alistair Francis Reviewed-by: Philippe Mathieu-Daudé Reviewed-by: Alistair Francis --- os-posix.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/os-posix.c b/os-posix.c index a2ba50d23f..24eb7007dc 100644 --- a/os-posix.c +++ b/os-posix.c @@ -125,7 +125,7 @@ void os_set_proc_name(const char *s) /* Could rewrite argv[0] too, but that's a bit more complicated. This simple way is enough for `top'. */ if (prctl(PR_SET_NAME, name)) { - perror("unable to change process name"); + error_report("unable to change process name: %s", strerror(errno)); exit(1); } #else @@ -247,7 +247,7 @@ static void change_root(void) exit(1); } if (chdir("/")) { - perror("not able to chdir to /"); + error_report("not able to chdir to /: %s", strerror(errno)); exit(1); } } @@ -309,7 +309,7 @@ void os_setup_post(void) if (daemonize) { if (chdir("/")) { - perror("not able to chdir to /"); + error_report("not able to chdir to /: %s", strerror(errno)); exit(1); } TFR(fd = qemu_open("/dev/null", O_RDWR)); @@ -383,7 +383,7 @@ int os_mlock(void) ret = mlockall(MCL_CURRENT | MCL_FUTURE); if (ret < 0) { - perror("mlockall"); + error_report("mlockall: %s", strerror(errno)); } return ret; From 8bbe05d77360b73c1834808023016a778ccf55ca Mon Sep 17 00:00:00 2001 From: Ian Jackson Date: Mon, 25 Sep 2017 16:41:03 +0100 Subject: [PATCH 16/16] configure: do_compiler: Dump some extra info under bash This makes it much easier to find a particular thing in config.log. We have to use the ${BASH_LINENO[*]} syntax which is a syntax error in other shells, so test what shell we are running and use eval. The extra output is only printed if configure is run with bash. On systems where /bin/sh is not bash, it is necessary to say bash ./configure to get the extra debug info in the log. Suggested-by: Eric Blake Signed-off-by: Ian Jackson CC: Kent R. Spillner CC: Janosch Frank CC: Thomas Huth CC: Peter Maydell CC: Paolo Bonzini Tested-by: Thomas Huth --- configure | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/configure b/configure index aa35aef14b..f9ba9eaae7 100755 --- a/configure +++ b/configure @@ -60,6 +60,11 @@ do_compiler() { # is compiler binary to execute. local compiler="$1" shift + if test -n "$BASH_VERSION"; then eval ' + echo >>config.log " +funcs: ${FUNCNAME[*]} +lines: ${BASH_LINENO[*]}" + '; fi echo $compiler "$@" >> config.log $compiler "$@" >> config.log 2>&1 || return $? # Test passed. If this is an --enable-werror build, rerun