From 8b5bc6c4790e7b269ec6360e2000bc5a9503a8da Mon Sep 17 00:00:00 2001
From: Cole Robinson <crobinso@redhat.com>
Date: Thu, 27 May 2010 19:17:55 -0400
Subject: [PATCH] qemu: Add a qemu.conf option for clearing capabilities

Currently there is no way to opt out of libvirt dropping POSIX
capabilities for qemu. This at least is a useful debugging tool, but
is also wanted by users (and distributors):

https://bugzilla.redhat.com/show_bug.cgi?id=559154
https://bugzilla.redhat.com/show_bug.cgi?id=573850

v2: Clarify qemu.conf comment, warn about security implications

v3: Add .aug changes
---
 src/qemu/libvirtd_qemu.aug      |  1 +
 src/qemu/qemu.conf              |  9 +++++++++
 src/qemu/qemu_conf.c            |  5 +++++
 src/qemu/qemu_conf.h            |  2 +-
 src/qemu/qemu_driver.c          | 11 +++++++++--
 src/qemu/test_libvirtd_qemu.aug |  4 ++++
 6 files changed, 29 insertions(+), 3 deletions(-)

diff --git a/src/qemu/libvirtd_qemu.aug b/src/qemu/libvirtd_qemu.aug
index 551cc20fd8..7c9f2712cd 100644
--- a/src/qemu/libvirtd_qemu.aug
+++ b/src/qemu/libvirtd_qemu.aug
@@ -39,6 +39,7 @@ module Libvirtd_qemu =
                  | str_entry "hugetlbfs_mount"
                  | bool_entry "relaxed_acs_check"
                  | bool_entry "vnc_allow_host_audio"
+                 | bool_entry "clear_emulator_capabilities"
 
    (* Each enty in the config is one of the following three ... *)
    let entry = vnc_entry
diff --git a/src/qemu/qemu.conf b/src/qemu/qemu.conf
index 98a117693f..93934f3982 100644
--- a/src/qemu/qemu.conf
+++ b/src/qemu/qemu.conf
@@ -178,3 +178,12 @@
 # QEMU_AUDIO_DRV environment variable when using VNC.
 #
 # vnc_allow_host_audio = 0
+
+# If clear_emulator_capabilities is enabled, libvirt will drop all
+# privileged capabilities of the QEmu/KVM emulator. This is enabled by
+# default.
+#
+# Warning: Disabling this option means that a compromised guest can
+# exploit the privileges and possibly do damage to the host.
+#
+# clear_emulator_capabilities = 1
diff --git a/src/qemu/qemu_conf.c b/src/qemu/qemu_conf.c
index 33e6b38c5b..16d2f44d74 100644
--- a/src/qemu/qemu_conf.c
+++ b/src/qemu/qemu_conf.c
@@ -104,6 +104,7 @@ int qemudLoadDriverConfig(struct qemud_driver *driver,
 
     /* Setup critical defaults */
     driver->dynamicOwnership = 1;
+    driver->clearEmulatorCapabilities = 1;
 
     if (!(driver->vncListen = strdup("127.0.0.1"))) {
         virReportOOMError();
@@ -355,6 +356,10 @@ int qemudLoadDriverConfig(struct qemud_driver *driver,
     CHECK_TYPE ("vnc_allow_host_audio", VIR_CONF_LONG);
     if (p) driver->vncAllowHostAudio = p->l;
 
+    p = virConfGetValue (conf, "clear_emulator_capabilities");
+    CHECK_TYPE ("clear_emulator_capabilities", VIR_CONF_LONG);
+    if (p) driver->clearEmulatorCapabilities = p->l;
+
     virConfFree (conf);
     return 0;
 }
diff --git a/src/qemu/qemu_conf.h b/src/qemu/qemu_conf.h
index 7616d151b2..0f8a1b3654 100644
--- a/src/qemu/qemu_conf.h
+++ b/src/qemu/qemu_conf.h
@@ -138,8 +138,8 @@ struct qemud_driver {
     ebtablesContext *ebtables;
 
     unsigned int relaxedACS : 1;
-
     unsigned int vncAllowHostAudio : 1;
+    unsigned int clearEmulatorCapabilities : 1;
 
     virCapsPtr caps;
 
diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c
index 477a221ac0..c8cd50ad60 100644
--- a/src/qemu/qemu_driver.c
+++ b/src/qemu/qemu_driver.c
@@ -3287,7 +3287,7 @@ static int qemudStartVMDaemon(virConnectPtr conn,
                               int stdin_fd) {
     const char **argv = NULL, **tmp;
     const char **progenv = NULL;
-    int i, ret;
+    int i, ret, runflags;
     struct stat sb;
     int *vmfds = NULL;
     int nvmfds = 0;
@@ -3501,9 +3501,16 @@ static int qemudStartVMDaemon(virConnectPtr conn,
     for (i = 0 ; i < nvmfds ; i++)
         FD_SET(vmfds[i], &keepfd);
 
+    VIR_DEBUG("Clear emulator capabilities: %d",
+              driver->clearEmulatorCapabilities);
+    runflags = VIR_EXEC_NONBLOCK;
+    if (driver->clearEmulatorCapabilities) {
+        runflags |= VIR_EXEC_CLEAR_CAPS;
+    }
+
     ret = virExecDaemonize(argv, progenv, &keepfd, &child,
                            stdin_fd, &logfile, &logfile,
-                           VIR_EXEC_NONBLOCK | VIR_EXEC_CLEAR_CAPS,
+                           runflags,
                            qemudSecurityHook, &hookData,
                            pidfile);
     VIR_FREE(pidfile);
diff --git a/src/qemu/test_libvirtd_qemu.aug b/src/qemu/test_libvirtd_qemu.aug
index a048ae55e6..3326cc5331 100644
--- a/src/qemu/test_libvirtd_qemu.aug
+++ b/src/qemu/test_libvirtd_qemu.aug
@@ -99,6 +99,8 @@ hugetlbfs_mount = \"/dev/hugepages\"
 relaxed_acs_check = 1
 
 vnc_allow_host_audio = 1
+
+clear_emulator_capabilities = 0
 "
 
    test Libvirtd_qemu.lns get conf =
@@ -208,3 +210,5 @@ vnc_allow_host_audio = 1
 { "relaxed_acs_check" = "1" }
 { "#empty" }
 { "vnc_allow_host_audio" = "1" }
+{ "#empty" }
+{ "clear_emulator_capabilities" = "0" }
-- 
GitLab