Add cap reduction support to enable use as SUID
The ideal way to use qemu-bridge-helper is to give it an fscap of using:
setcap cap_net_admin=ep qemu-bridge-helper
Unfortunately, most distros still do not have a mechanism to package files
with fscaps applied. This means they'll have to SUID the qemu-bridge-helper
binary.
To improve security, use libcap to reduce our capability set to just
cap_net_admin, then reduce privileges down to the calling user. This is
hopefully close to equivalent to fscap support from a security perspective.
Signed-off-by: Anthony Liguori <[email protected]>
Signed-off-by: Richa Marwaha <[email protected]>
Signed-off-by: Corey Bryant <[email protected]>
Signed-off-by: Anthony Liguori <[email protected]>
diff --git a/configure b/configure
index b7e5ca6..9f2a7e1 100755
--- a/configure
+++ b/configure
@@ -133,6 +133,7 @@
xen=""
xen_ctrl_version=""
linux_aio=""
+cap_ng=""
attr=""
libattr=""
xfs=""
@@ -672,6 +673,10 @@
;;
--enable-tcg-interpreter) tcg_interpreter="yes"
;;
+ --disable-cap-ng) cap_ng="no"
+ ;;
+ --enable-cap-ng) cap_ng="yes"
+ ;;
--disable-spice) spice="no"
;;
--enable-spice) spice="yes"
@@ -1053,6 +1058,8 @@
echo " --enable-vde enable support for vde network"
echo " --disable-linux-aio disable Linux AIO support"
echo " --enable-linux-aio enable Linux AIO support"
+echo " --disable-cap-ng disable libcap-ng support"
+echo " --enable-cap-ng enable libcap-ng support"
echo " --disable-attr disables attr and xattr support"
echo " --enable-attr enable attr and xattr support"
echo " --disable-blobs disable installing provided firmware blobs"
@@ -1745,6 +1752,29 @@
fi
##########################################
+# libcap-ng library probe
+if test "$cap_ng" != "no" ; then
+ cap_libs="-lcap-ng"
+ cat > $TMPC << EOF
+#include <cap-ng.h>
+int main(void)
+{
+ capng_capability_to_name(CAPNG_EFFECTIVE);
+ return 0;
+}
+EOF
+ if compile_prog "" "$cap_libs" ; then
+ cap_ng=yes
+ libs_tools="$cap_libs $libs_tools"
+ else
+ if test "$cap_ng" = "yes" ; then
+ feature_not_found "cap_ng"
+ fi
+ cap_ng=no
+ fi
+fi
+
+##########################################
# Sound support libraries probe
audio_drv_probe()
@@ -2876,6 +2906,7 @@
echo "madvise $madvise"
echo "posix_madvise $posix_madvise"
echo "uuid support $uuid"
+echo "libcap-ng support $cap_ng"
echo "vhost-net support $vhost_net"
echo "Trace backend $trace_backend"
echo "Trace output file $trace_file-<pid>"
@@ -2980,6 +3011,9 @@
if test "$vde" = "yes" ; then
echo "CONFIG_VDE=y" >> $config_host_mak
fi
+if test "$cap_ng" = "yes" ; then
+ echo "CONFIG_LIBCAP=y" >> $config_host_mak
+fi
for card in $audio_card_list; do
def=CONFIG_`echo $card | tr '[:lower:]' '[:upper:]'`
echo "$def=y" >> $config_host_mak
