diff mbox series

[bug#43650,1/8] services: hurd-vm: Run QEMU as an unprivileged user.

Message ID 20200927153221.9154-1-ludo@gnu.org
State Accepted
Headers show
Series Assorted childhurd improvements | expand

Checks

Context Check Description
cbaines/comparison success View comparision
cbaines/git branch success View Git branch
cbaines/applying patch success View Laminar job
cbaines/comparison success View comparision
cbaines/git branch success View Git branch
cbaines/applying patch success View Laminar job
cbaines/comparison success View comparision
cbaines/git branch success View Git branch
cbaines/applying patch success View Laminar job

Commit Message

Ludovic Courtès Sept. 27, 2020, 3:32 p.m. UTC 
Until qemu was running as "root", which is unnecessary.

* gnu/services/virtualization.scm (%hurd-vm-accounts): New variable.
(hurd-vm-service-type)[extensions]: Add ACCOUNT-SERVICE-TYPE extension.
---
 gnu/services/virtualization.scm | 43 +++++++++++++++++++++++----------
 1 file changed, 30 insertions(+), 13 deletions(-)

Comments

Janneke Nieuwenhuizen Sept. 28, 2020, 4:57 p.m. UTC | #1 
Ludovic Courtès writes:

Hello!

> Until qemu was running as "root", which is unnecessary.

Well...I can't get this to work; my childhurd does not run.  Did you
test it?  Any special tricks needed, adding "childhurd" to "kvm" maybe?

I do like the idea...

Greetings,
Janneke
Ludovic Courtès Sept. 28, 2020, 10:19 p.m. UTC | #2 
Hi,

Jan Nieuwenhuizen <janneke@gnu.org> skribis:

>> Until qemu was running as "root", which is unnecessary.
>
> Well...I can't get this to work; my childhurd does not run.  Did you
> test it?  Any special tricks needed, adding "childhurd" to "kvm" maybe?

I did test it, but it seems there’s “something” that sometimes leads to
a startup failure and subsequent respawn of the Shepherd service (it can
be seen in the output of “herd status childhurd”).  Typically if I “herd
restart childhurd” it then proceeds and works.

To be continued…

Thanks for testing!

Ludo’.
Efraim Flashner Sept. 29, 2020, 7:06 a.m. UTC | #3 
On Mon, Sep 28, 2020 at 06:57:00PM +0200, Jan Nieuwenhuizen wrote:
> Ludovic Courtès writes:
> 
> Hello!
> 
> > Until qemu was running as "root", which is unnecessary.
> 
> Well...I can't get this to work; my childhurd does not run.  Did you
> test it?  Any special tricks needed, adding "childhurd" to "kvm" maybe?
> 
> I do like the idea...
> 
> Greetings,
> Janneke
> 

Shot in the dark, do the permissions/ownership on /var/empty matter?
childhurd is far from the only user claiming /var/empty as home.
Ludovic Courtès Sept. 29, 2020, 10:23 a.m. UTC | #4 
Efraim Flashner <efraim@flashner.co.il> skribis:

> Shot in the dark, do the permissions/ownership on /var/empty matter?
> childhurd is far from the only user claiming /var/empty as home.

I don’t think so.  There’s code somewhere that ensures that /var/empty
is root-owned and read-only.

Ludo’.
diff mbox series

Patch

diff --git a/gnu/services/virtualization.scm b/gnu/services/virtualization.scm
index 20e104f48c..55a19d7af9 100644
--- a/gnu/services/virtualization.scm
+++ b/gnu/services/virtualization.scm
@@ -959,28 +959,45 @@  is added to the OS specified in CONFIG."
        (with-imported-modules
            (source-module-closure '((gnu build secret-service)
                                     (guix build utils)))
-         #~(let ((spawn (make-forkexec-constructor #$vm-command)))
-             (lambda _
-               (let ((pid (spawn))
-                     (port #$(hurd-vm-port config %hurd-vm-secrets-port))
-                     (root #$(hurd-vm-configuration-secret-root config)))
-                 (catch #t
-                   (lambda _
-                     (secret-service-send-secrets port root))
-                   (lambda (key . args)
-                     (kill (- pid) SIGTERM)
-                     (apply throw key args)))
-                 pid)))))
+         #~(lambda ()
+             (let ((pid  (fork+exec-command #$vm-command
+                                            #:user "childhurd"
+                                            #:group "childhurd"
+                                            #:environment-variables
+                                            ;; QEMU tries to write to /var/tmp
+                                            ;; by default.
+                                            '("TMPDIR=/tmp")))
+                   (port #$(hurd-vm-port config %hurd-vm-secrets-port))
+                   (root #$(hurd-vm-configuration-secret-root config)))
+               (catch #t
+                 (lambda _
+                   (secret-service-send-secrets port root)
+                   pid)
+                 (lambda (key . args)
+                   (kill (- pid) SIGTERM)
+                   (apply throw key args)))))))
       (modules `((gnu build secret-service)
                  (guix build utils)
                  ,@%default-modules))
       (stop  #~(make-kill-destructor))))))
 
+(define %hurd-vm-accounts
+  (list (user-group (name "childhurd") (system? #t))
+        (user-account
+         (name "childhurd")
+         (group "childhurd")
+         (comment "Privilege separation user for the childhurd")
+         (home-directory "/var/empty")
+         (shell (file-append shadow "/sbin/nologin"))
+         (system? #t))))
+
 (define hurd-vm-service-type
   (service-type
    (name 'hurd-vm)
    (extensions (list (service-extension shepherd-root-service-type
-                                        hurd-vm-shepherd-service)))
+                                        hurd-vm-shepherd-service)
+                     (service-extension account-service-type
+                                        (const %hurd-vm-accounts))))
    (default-value (hurd-vm-configuration))
    (description
     "Provide a Virtual Machine running the GNU/Hurd.")))