[Qemu-devel] [Bug 807893] Re: qemu privilege escalation

[Mike Cao]

I think I verified this issue on lastest qemu

steps:
1./configure && make
2.start  qemu-kvm process with -runas nobody
./qemu-system-x86_64 -m 2G -smp 4 -cpu qemu64,+x2apic -usbdevice tablet -drive 
file=/home/win2003-32-new.raw,if=none,id=drive-ide0-0-0,werror=stop,rerror=stop,cache=none,format=raw
 -device 
ide-drive,bus=ide.0,unit=0,bootindex=1,drive=drive-ide0-0-0,id=ide0-0-0 -netdev 
tap,id=hostnet0,script=/etc/qemu-ifup,downscript=no -device 
rtl8139,netdev=hostnet0,mac=76:0E:40:3F:2F:3F -boot dc -uuid 
cc5aee77-d631-41d4-92a0-4e59c3b5cb6c -rtc-td-hack -monitor stdio -name 
win2k3-32-serial -vnc :10 -device virtio-balloon-pci,id=balloon0 -runas nobody

3# cat /proc/25996/status 
Name:   qemu-system-x86
State:  R (running)
Tgid:   25996
Pid:    25996
PPid:   28206
TracerPid:      0
Uid:    99      99      99      99
Gid:    99      99      99      99
Utrace: 0
FDSize: 256
Groups: 99 

4# cat /proc/25996/task/25996/status 
Name:   qemu-system-x86
State:  R (running)
Tgid:   25996
Pid:    25996
PPid:   28206
TracerPid:      0
Uid:    99      99      99      99
Gid:    99      99      99      99
Utrace: 0
FDSize: 256
Groups: 99 

Based on above ,I think this bug has been fixed ald.

Best Regards,
Mike

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/807893

Title:
  qemu privilege escalation

Status in QEMU:
  Confirmed

Bug description:
  If qemu is started as root, with -runas, the extra groups is not
  dropped correctly

  /proc/`pidof qemu`/status
  ..
  Uid:    100     100     100     100
  Gid:    100     100     100     100
  FDSize: 32
  Groups: 0 1 2 3 4 6 10 11 26 27 
  ...

  The fix is to add initgroups() or setgroups(1, [gid]) where
  appropriate to os-posix.c.

  The extra gid's allow read or write access to other files (such as
  /dev etc).

  Emulating the qemu code:

  # python
  ...
  >>> import os
  >>> os.setgid(100)
  >>> os.setuid(100)
  >>> os.execve("/bin/sh", [ "/bin/sh" ], os.environ)
  sh-4.1$ xxd /dev/sda | head -n2
  0000000: eb48 9000 0000 0000 0000 0000 0000 0000  .H..............
  0000010: 0000 0000 0000 0000 0000 0000 0000 0000  ................
  sh-4.1$ ls -l /dev/sda
  brw-rw---- 1 root disk 8, 0 Jul  8 11:54 /dev/sda
  sh-4.1$ id
  uid=100(qemu00) gid=100(users) 
groups=100(users),0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),11(floppy),26(tape),27(video)

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/807893/+subscriptions