From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mp0 ([2001:41d0:2:4a6f::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) by ms11 with LMTPS id gIY7CbewcF8BBAAA0tVLHw (envelope-from ) for ; Sun, 27 Sep 2020 15:33:11 +0000 Received: from aspmx1.migadu.com ([2001:41d0:2:4a6f::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) by mp0 with LMTPS id uJYzBbewcF+DUQAA1q6Kng (envelope-from ) for ; Sun, 27 Sep 2020 15:33:11 +0000 Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by aspmx1.migadu.com (Postfix) with ESMTPS id C1E699404CA for ; Sun, 27 Sep 2020 15:33:10 +0000 (UTC) Received: from localhost ([::1]:50006 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1kMYfl-00030a-Pu for larch@yhetil.org; Sun, 27 Sep 2020 11:33:09 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:54500) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1kMYff-00030K-5x for guix-patches@gnu.org; Sun, 27 Sep 2020 11:33:03 -0400 Received: from debbugs.gnu.org ([209.51.188.43]:38663) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1kMYfe-0003uD-SN for guix-patches@gnu.org; Sun, 27 Sep 2020 11:33:02 -0400 Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1kMYfe-0002l9-Pe for guix-patches@gnu.org; Sun, 27 Sep 2020 11:33:02 -0400 X-Loop: help-debbugs@gnu.org Subject: [bug#43650] [PATCH 1/8] services: hurd-vm: Run QEMU as an unprivileged user. References: <20200927152932.8924-1-ludo@gnu.org> In-Reply-To: <20200927152932.8924-1-ludo@gnu.org> Resent-From: Ludovic =?UTF-8?Q?Court=C3=A8s?= Original-Sender: "Debbugs-submit" Resent-CC: guix-patches@gnu.org Resent-Date: Sun, 27 Sep 2020 15:33:02 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 43650 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: 43650@debbugs.gnu.org Cc: Ludovic =?UTF-8?Q?Court=C3=A8s?= , janneke@gnu.org Received: via spool by 43650-submit@debbugs.gnu.org id=B43650.160122076010516 (code B ref 43650); Sun, 27 Sep 2020 15:33:02 +0000 Received: (at 43650) by debbugs.gnu.org; 27 Sep 2020 15:32:40 +0000 Received: from localhost ([127.0.0.1]:50196 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1kMYfH-0002jY-Rw for submit@debbugs.gnu.org; Sun, 27 Sep 2020 11:32:40 -0400 Received: from eggs.gnu.org ([209.51.188.92]:47576) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1kMYfG-0002jI-AL for 43650@debbugs.gnu.org; Sun, 27 Sep 2020 11:32:38 -0400 Received: from fencepost.gnu.org ([2001:470:142:3::e]:52524) by eggs.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1kMYfB-0003sF-1W; Sun, 27 Sep 2020 11:32:33 -0400 Received: from [2a01:e0a:1d:7270:af76:b9b:ca24:c465] (port=38894 helo=gnu.org) by fencepost.gnu.org with esmtpsa (TLS1.2:DHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.82) (envelope-from ) id 1kMYf7-00016f-Rm; Sun, 27 Sep 2020 11:32:30 -0400 From: Ludovic =?UTF-8?Q?Court=C3=A8s?= Date: Sun, 27 Sep 2020 17:32:14 +0200 Message-Id: <20200927153221.9154-1-ludo@gnu.org> X-Mailer: git-send-email 2.28.0 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Spam-Score: -2.3 (--) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list X-Spam-Score: -3.3 (---) X-BeenThere: guix-patches@gnu.org List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-patches-bounces+larch=yhetil.org@gnu.org Sender: "Guix-patches" X-Scanner: scn0 Authentication-Results: aspmx1.migadu.com; dkim=none; dmarc=pass (policy=none) header.from=gnu.org; spf=pass (aspmx1.migadu.com: domain of guix-patches-bounces@gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=guix-patches-bounces@gnu.org X-Spam-Score: 3.49 X-TUID: 6yTetr+ei7cu Until qemu was running as "root", which is unnecessary. * gnu/services/virtualization.scm (%hurd-vm-accounts): New variable. (hurd-vm-service-type)[extensions]: Add ACCOUNT-SERVICE-TYPE extension. --- gnu/services/virtualization.scm | 43 +++++++++++++++++++++++---------- 1 file changed, 30 insertions(+), 13 deletions(-) diff --git a/gnu/services/virtualization.scm b/gnu/services/virtualization.scm index 20e104f48c..55a19d7af9 100644 --- a/gnu/services/virtualization.scm +++ b/gnu/services/virtualization.scm @@ -959,28 +959,45 @@ is added to the OS specified in CONFIG." (with-imported-modules (source-module-closure '((gnu build secret-service) (guix build utils))) - #~(let ((spawn (make-forkexec-constructor #$vm-command))) - (lambda _ - (let ((pid (spawn)) - (port #$(hurd-vm-port config %hurd-vm-secrets-port)) - (root #$(hurd-vm-configuration-secret-root config))) - (catch #t - (lambda _ - (secret-service-send-secrets port root)) - (lambda (key . args) - (kill (- pid) SIGTERM) - (apply throw key args))) - pid))))) + #~(lambda () + (let ((pid (fork+exec-command #$vm-command + #:user "childhurd" + #:group "childhurd" + #:environment-variables + ;; QEMU tries to write to /var/tmp + ;; by default. + '("TMPDIR=/tmp"))) + (port #$(hurd-vm-port config %hurd-vm-secrets-port)) + (root #$(hurd-vm-configuration-secret-root config))) + (catch #t + (lambda _ + (secret-service-send-secrets port root) + pid) + (lambda (key . args) + (kill (- pid) SIGTERM) + (apply throw key args))))))) (modules `((gnu build secret-service) (guix build utils) ,@%default-modules)) (stop #~(make-kill-destructor)))))) +(define %hurd-vm-accounts + (list (user-group (name "childhurd") (system? #t)) + (user-account + (name "childhurd") + (group "childhurd") + (comment "Privilege separation user for the childhurd") + (home-directory "/var/empty") + (shell (file-append shadow "/sbin/nologin")) + (system? #t)))) + (define hurd-vm-service-type (service-type (name 'hurd-vm) (extensions (list (service-extension shepherd-root-service-type - hurd-vm-shepherd-service))) + hurd-vm-shepherd-service) + (service-extension account-service-type + (const %hurd-vm-accounts)))) (default-value (hurd-vm-configuration)) (description "Provide a Virtual Machine running the GNU/Hurd."))) -- 2.28.0