From: Thomas Huth <thuth@redhat.com>
To: Claudio Fontana <cfontana@suse.de>,
qemu-devel@nongnu.org, Paolo Bonzini <pbonzini@redhat.com>
Cc: devel@lists.libvirt.org,
"Philippe Mathieu-Daudé" <philmd@linaro.org>,
"Claudio Imbrenda" <imbrenda@linux.ibm.com>
Subject: Re: [PATCH v2] qemu-options: Deprecate "-runas" and introduce "-run-with user=..." instead
Date: Wed, 8 May 2024 16:00:27 +0200 [thread overview]
Message-ID: <4f662f6b-f972-4d07-954f-1a733d52b4e1@redhat.com> (raw)
In-Reply-To: <b39ca716-65eb-463e-bf30-6a07413d5d91@suse.de>
On 08/05/2024 15.20, Claudio Fontana wrote:
> On 5/6/24 13:20, Thomas Huth wrote:
>> The old "-runas" option has the disadvantage that it is not visible
>> in the QAPI schema, so it is not available via the normal introspection
>> mechanisms. We've recently introduced the "-run-with" option for exactly
>> this purpose, which is meant to handle the options that affect the
>> runtime behavior. Thus let's introduce a "user=..." parameter here now
>> and deprecate the old "-runas" option.
>>
>> Signed-off-by: Thomas Huth <thuth@redhat.com>
>> ---
>> v2: Add missing part in qemu-options.hx as suggested by Philippe
>>
>> docs/about/deprecated.rst | 6 ++++++
>> system/vl.c | 15 +++++++++++++++
>> qemu-options.hx | 15 +++++++++++----
>> 3 files changed, 32 insertions(+), 4 deletions(-)
>>
>> diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst
>> index 3310df3274..fe69e2d44c 100644
>> --- a/docs/about/deprecated.rst
>> +++ b/docs/about/deprecated.rst
>> @@ -61,6 +61,12 @@ configurations (e.g. -smp drawers=1,books=1,clusters=1 for x86 PC machine) is
>> marked deprecated since 9.0, users have to ensure that all the topology members
>> described with -smp are supported by the target machine.
>>
>> +``-runas`` (since 9.1)
>> +----------------------
>> +
>> +Use ``-run-with user=..`` instead.
>> +
>> +
>> User-mode emulator command line arguments
>> -----------------------------------------
>>
>> diff --git a/system/vl.c b/system/vl.c
>> index 7756eac81e..b031427440 100644
>> --- a/system/vl.c
>> +++ b/system/vl.c
>> @@ -773,6 +773,10 @@ static QemuOptsList qemu_run_with_opts = {
>> .name = "chroot",
>> .type = QEMU_OPT_STRING,
>> },
>> + {
>> + .name = "user",
>> + .type = QEMU_OPT_STRING,
>> + },
>> { /* end of list */ }
>> },
>> };
>> @@ -3586,6 +3590,7 @@ void qemu_init(int argc, char **argv)
>> break;
>> #if defined(CONFIG_POSIX)
>> case QEMU_OPTION_runas:
>> + warn_report("-runas is deprecated, use '-run-with user=...' instead");
>> if (!os_set_runas(optarg)) {
>> error_report("User \"%s\" doesn't exist"
>> " (and is not <uid>:<gid>)",
>> @@ -3612,6 +3617,16 @@ void qemu_init(int argc, char **argv)
>> if (str) {
>> os_set_chroot(str);
>> }
>> + str = qemu_opt_get(opts, "user");
>> + if (str) {
>> + if (!os_set_runas(str)) {
>> + error_report("User \"%s\" doesn't exist"
>> + " (and is not <uid>:<gid>)",
>> + optarg);
>> + exit(1);
>> + }
>> + }
>> +
>> break;
>> }
>> #endif /* CONFIG_POSIX */
>> diff --git a/qemu-options.hx b/qemu-options.hx
>> index cf61f6b863..3031479a15 100644
>> --- a/qemu-options.hx
>> +++ b/qemu-options.hx
>> @@ -4824,7 +4824,8 @@ DEF("runas", HAS_ARG, QEMU_OPTION_runas, \
>> SRST
>> ``-runas user``
>> Immediately before starting guest execution, drop root privileges,
>> - switching to the specified user.
>> + switching to the specified user. This option is deprecated, use
>> + ``-run-with user=...`` instead.
>> ERST
>>
>> DEF("prom-env", HAS_ARG, QEMU_OPTION_prom_env,
>> @@ -4990,13 +4991,15 @@ DEF("qtest-log", HAS_ARG, QEMU_OPTION_qtest_log, "", QEMU_ARCH_ALL)
>>
>> #ifdef CONFIG_POSIX
>> DEF("run-with", HAS_ARG, QEMU_OPTION_run_with,
>> - "-run-with [async-teardown=on|off][,chroot=dir]\n"
>> + "-run-with [async-teardown=on|off][,chroot=dir][user=username|uid:gid]\n"
>> " Set miscellaneous QEMU process lifecycle options:\n"
>> " async-teardown=on enables asynchronous teardown (Linux only)\n"
>> - " chroot=dir chroot to dir just before starting the VM\n",
>> + " chroot=dir chroot to dir just before starting the VM\n"
>> + " user=username switch to the specified user before starting the VM\n"
>> + " user=uid:gid dito, but use specified user-ID and group-ID instead\n",
>
> nit: ditto?
Thanks, I'll fix it!
Thomas
prev parent reply other threads:[~2024-05-08 14:01 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-05-06 11:20 [PATCH v2] qemu-options: Deprecate "-runas" and introduce "-run-with user=..." instead Thomas Huth
2024-05-06 11:42 ` Philippe Mathieu-Daudé
2024-05-06 13:10 ` Paolo Bonzini
2024-05-08 13:20 ` Claudio Fontana
2024-05-08 14:00 ` Thomas Huth [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4f662f6b-f972-4d07-954f-1a733d52b4e1@redhat.com \
--to=thuth@redhat.com \
--cc=cfontana@suse.de \
--cc=devel@lists.libvirt.org \
--cc=imbrenda@linux.ibm.com \
--cc=pbonzini@redhat.com \
--cc=philmd@linaro.org \
--cc=qemu-devel@nongnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).