libvirt-daemon-system package runs dnsmasq as nobody

[Apicultor]

libvirt-daemon-system package runs dnsmasq as 'nobody'.

$ lsb_release -rd
Description: Ubuntu Bionic Beaver (development branch)
Release: 18.04

$ apt-cache policy libvirt-daemon-system
libvirt-daemon-system:
  Instal·lat: 3.6.0-1ubuntu6
  Candidat: 3.6.0-1ubuntu6
  Taula de versió:
 *** 3.6.0-1ubuntu6 500
        500 http://es.archive.ubuntu.com/ubuntu bionic/main amd64 Packages
        100 /var/lib/dpkg/status

$ sudo apt install libvirt-daemon-system
S'està llegint la llista de paquets… Fet
S'està construint l'arbre de dependències
S'està llegint la informació de l'estat… Fet
S'instal·laran els següents paquets extres:
  libvirt-daemon
Paquets suggerits:
  numad radvd auditd systemtap nfs-common zfsutils pm-utils
S'instal·laran els paquets NOUS següents:
  libvirt-daemon libvirt-daemon-system
0 actualitzats, 2 nous a instal·lar, 0 a suprimir i 0 no actualitzats.
S'ha d'obtenir 0 B/2227 kB d'arxius.
Després d'aquesta operació s'empraran 10,3 MB d'espai en disc addicional.
Voleu continuar? [S/n]
S'estan preconfigurant els paquets...
S'està seleccionant el paquet libvirt-daemon prèviament no seleccionat.
(S'està llegint la base de dades… hi ha 150336 fitxers i directoris instal·lats actualment.)
S'està preparant per a desempaquetar …/libvirt-daemon_3.6.0-1ubuntu6_amd64.deb…
S'està desempaquetant libvirt-daemon (3.6.0-1ubuntu6)…
S'està seleccionant el paquet libvirt-daemon-system prèviament no seleccionat.
S'està preparant per a desempaquetar …/libvirt-daemon-system_3.6.0-1ubuntu6_amd64.deb…
S'està desempaquetant libvirt-daemon-system (3.6.0-1ubuntu6)…
S'estan processant els activadors per a ureadahead (0.100.0-20)…
ureadahead will be reprofiled on next reboot
S'està configurant libvirt-daemon (3.6.0-1ubuntu6)…
S'estan processant els activadors per a systemd (235-3ubuntu3)…
S'estan processant els activadors per a man-db (2.7.6.1-4)…
S'està configurant libvirt-daemon-system (3.6.0-1ubuntu6)…
S'està afegint l'usuari libvirt-qemu al grup libvirt-qemu
Created symlink /etc/systemd/system/multi-user.target.wants/libvirt-guests.service → /lib/systemd/system/libvirt-guests.service.
Created symlink /etc/systemd/system/libvirt-bin.service → /lib/systemd/system/libvirtd.service.
Created symlink /etc/systemd/system/multi-user.target.wants/libvirtd.service → /lib/systemd/system/libvirtd.service.
Created symlink /etc/systemd/system/sockets.target.wants/virtlockd.socket → /lib/systemd/system/virtlockd.socket.
Created symlink /etc/systemd/system/sockets.target.wants/virtlogd.socket → /lib/systemd/system/virtlogd.socket.
virtlockd.service is a disabled or a static unit, not starting it.
Setting up libvirt-daemon dnsmasq configuration.
S'estan processant els activadors per a ureadahead (0.100.0-20)…
S'estan processant els activadors per a systemd (235-3ubuntu3)…

$ service libvirtd status
● libvirtd.service - Virtualization daemon
   Loaded: loaded (/lib/systemd/system/libvirtd.service; enabled; vendor preset:
   Active: active (running) since Tue 2018-01-16 18:16:08 CET; 7s ago
     Docs: man:libvirtd(8)
           http://libvirt.org
 Main PID: 3476 (libvirtd)
    Tasks: 18 (limit: 32768)
   CGroup: /system.slice/libvirtd.service
           ├─3476 /usr/sbin/libvirtd
           ├─3771 /usr/sbin/dnsmasq --conf-file=/var/lib/libvirt/dnsmasq/default
           └─3772 /usr/sbin/dnsmasq --conf-file=/var/lib/libvirt/dnsmasq/default

gen 16 18:16:08 desktop systemd[1]: Started Virtualization daemon.
gen 16 18:16:09 desktop dnsmasq[3771]: started, version 2.78 cachesize 150
gen 16 18:16:09 desktop dnsmasq[3771]: compile time options: IPv6 GNU-getopt DBu
gen 16 18:16:09 desktop dnsmasq-dhcp[3771]: DHCP, IP range 192.168.122.2 -- 192.
gen 16 18:16:09 desktop dnsmasq-dhcp[3771]: DHCP, sockets bound exclusively to i
gen 16 18:16:09 desktop dnsmasq[3771]: reading /etc/resolv.conf
gen 16 18:16:09 desktop dnsmasq[3771]: using nameserver 127.0.0.53#53
gen 16 18:16:09 desktop dnsmasq[3771]: read /etc/hosts - 7 addresses
gen 16 18:16:09 desktop dnsmasq[3771]: read /var/lib/libvirt/dnsmasq/default.add
gen 16 18:16:09 desktop dnsmasq-dhcp[3771]: read /var/lib/libvirt/dnsmasq/defaul

$ sudo ps aux | grep dnsmasq | grep -v grep
nobody 3771 0.0 0.0 54552 388 ? S 18:16 0:00 /usr/sbin/dnsmasq --conf-file=/var/lib/libvirt/dnsmasq/default.conf --leasefile-ro --dhcp-script=/usr/lib/libvirt/libvirt_leaseshelper
root 3772 0.0 0.0 54524 388 ? S 18:16 0:00 /usr/sbin/dnsmasq --conf-file=/var/lib/libvirt/dnsmasq/default.conf --leasefile-ro --dhcp-script=/usr/lib/libvirt/libvirt_leaseshelper

ProblemType: Bug
DistroRelease: Ubuntu 18.04
Package: libvirt-daemon-system 3.6.0-1ubuntu6
ProcVersionSignature: Ubuntu 4.13.0-25.29-generic 4.13.13
Uname: Linux 4.13.0-25-generic x86_64
ApportVersion: 2.20.8-0ubuntu6
Architecture: amd64
CurrentDesktop: ubuntu:GNOME
Date: Tue Jan 16 18:18:29 2018
InstallationDate: Installed on 2018-01-16 (0 days ago)
InstallationMedia: Ubuntu 18.04 LTS "Bionic Beaver" - Alpha amd64 (20180115)
SourcePackage: libvirt
UpgradeStatus: No upgrade log present (probably fresh install)
modified.conffile..etc.libvirt.nwfilter.allow-arp.xml: [inaccessible: [Errno 13] S’ha denegat el permís: '/etc/libvirt/nwfilter/allow-arp.xml']
modified.conffile..etc.libvirt.nwfilter.allow-dhcp-server.xml: [inaccessible: [Errno 13] S’ha denegat el permís: '/etc/libvirt/nwfilter/allow-dhcp-server.xml']
modified.conffile..etc.libvirt.nwfilter.allow-dhcp.xml: [inaccessible: [Errno 13] S’ha denegat el permís: '/etc/libvirt/nwfilter/allow-dhcp.xml']
modified.conffile..etc.libvirt.nwfilter.allow-incoming-ipv4.xml: [inaccessible: [Errno 13] S’ha denegat el permís: '/etc/libvirt/nwfilter/allow-incoming-ipv4.xml']
modified.conffile..etc.libvirt.nwfilter.allow-ipv4.xml: [inaccessible: [Errno 13] S’ha denegat el permís: '/etc/libvirt/nwfilter/allow-ipv4.xml']
modified.conffile..etc.libvirt.nwfilter.clean-traffic.xml: [inaccessible: [Errno 13] S’ha denegat el permís: '/etc/libvirt/nwfilter/clean-traffic.xml']
modified.conffile..etc.libvirt.nwfilter.no-arp-ip-spoofing.xml: [inaccessible: [Errno 13] S’ha denegat el permís: '/etc/libvirt/nwfilter/no-arp-ip-spoofing.xml']
modified.conffile..etc.libvirt.nwfilter.no-arp-mac-spoofing.xml: [inaccessible: [Errno 13] S’ha denegat el permís: '/etc/libvirt/nwfilter/no-arp-mac-spoofing.xml']
modified.conffile..etc.libvirt.nwfilter.no-arp-spoofing.xml: [inaccessible: [Errno 13] S’ha denegat el permís: '/etc/libvirt/nwfilter/no-arp-spoofing.xml']
modified.conffile..etc.libvirt.nwfilter.no-ip-multicast.xml: [inaccessible: [Errno 13] S’ha denegat el permís: '/etc/libvirt/nwfilter/no-ip-multicast.xml']
modified.conffile..etc.libvirt.nwfilter.no-ip-spoofing.xml: [inaccessible: [Errno 13] S’ha denegat el permís: '/etc/libvirt/nwfilter/no-ip-spoofing.xml']
modified.conffile..etc.libvirt.nwfilter.no-mac-broadcast.xml: [inaccessible: [Errno 13] S’ha denegat el permís: '/etc/libvirt/nwfilter/no-mac-broadcast.xml']
modified.conffile..etc.libvirt.nwfilter.no-mac-spoofing.xml: [inaccessible: [Errno 13] S’ha denegat el permís: '/etc/libvirt/nwfilter/no-mac-spoofing.xml']
modified.conffile..etc.libvirt.nwfilter.no-other-l2-traffic.xml: [inaccessible: [Errno 13] S’ha denegat el permís: '/etc/libvirt/nwfilter/no-other-l2-traffic.xml']
modified.conffile..etc.libvirt.nwfilter.no-other-rarp-traffic.xml: [inaccessible: [Errno 13] S’ha denegat el permís: '/etc/libvirt/nwfilter/no-other-rarp-traffic.xml']
modified.conffile..etc.libvirt.nwfilter.qemu-announce-self-rarp.xml: [inaccessible: [Errno 13] S’ha denegat el permís: '/etc/libvirt/nwfilter/qemu-announce-self-rarp.xml']
modified.conffile..etc.libvirt.nwfilter.qemu-announce-self.xml: [inaccessible: [Errno 13] S’ha denegat el permís: '/etc/libvirt/nwfilter/qemu-announce-self.xml']
modified.conffile..etc.libvirt.qemu.conf: [inaccessible: [Errno 13] S’ha denegat el permís: '/etc/libvirt/qemu.conf']
modified.conffile..etc.libvirt.qemu.networks.default.xml: [inaccessible: [Errno 13] S’ha denegat el permís: '/etc/libvirt/qemu/networks/default.xml']

[Seth Arnold (seth-arnold)]

I believe this is working as designed: one process is the parent of the other:

$ sudo ps -C dnsmasq -ocomm,euid,uid,pid,ppid,args | cat
COMMAND EUID UID PID PPID COMMAND
dnsmasq 118 118 2815 1 /usr/sbin/dnsmasq --conf-file=/var/lib/libvirt/dnsmasq/default.conf --leasefile-ro --dhcp-script=/usr/lib/libvirt/libvirt_leaseshelper
dnsmasq 0 0 2816 2815 /usr/sbin/dnsmasq --conf-file=/var/lib/libvirt/dnsmasq/default.conf --leasefile-ro --dhcp-script=/usr/lib/libvirt/libvirt_leaseshelper

BTW, 'nobody' is strictly reserved for NFS use. If any processes run as user 'nobody' then that process would have undue influence over NFS.

Thanks

[Apicultor (apicultor)]

>BTW, 'nobody' is strictly reserved for NFS use. If any processes run as user 'nobody' then that process would have undue influence over NFS.

Did you miss this bit, where dnsmasq *is* running as "nobody"?

$ sudo ps aux | grep dnsmasq | grep -v grep
nobody 3771 0.0 0.0 54552 388 ? S 18:16 0:00 /usr/sbin/dnsmasq --conf-file=/var/lib/libvirt/dnsmasq/default.conf --leasefile-ro --dhcp-script=/usr/lib/libvirt/libvirt_leaseshelper
root 3772 0.0 0.0 54524 388 ? S 18:16 0:00 /usr/sbin/dnsmasq --conf-file=/var/lib/libvirt/dnsmasq/default.conf --leasefile-ro --dhcp-script=/usr/lib/libvirt/libvirt_leaseshelper

Having two copies of it running doesn't seem like the correct behaviour to me.

[Serge Hallyn (serge-hallyn)]

@apricultor - that does look wrong. On my system (xenial) the libvirt dnsmasq is running as libvirt-dnsmasq user. It should *not* be running as nobody.

[Serge Hallyn (serge-hallyn)]

So - the two processes, one as root, one as unpriv, is expected.

The use of 'nobody' is a bug in the libvirt packaging, or a misconfiguration on your system (in which case we should figure out what happened).

Let me setup a bionic vm host and see what I get :)

[Serge Hallyn (serge-hallyn)]

Indeed - in a newly created artful VM, I get the same thing:

nobody 3674 1 0 16:53 ? 00:00:00 /usr/sbin/dnsmasq --conf-file=/var/lib/libvirt/dnsmasq/default.conf --leasefile-ro --dhcp-script=/usr/lib/libvirt/libvirt_leaseshelper
root 3675 3674 0 16:53 ? 00:00:00 /usr/sbin/dnsmasq --conf-file=/var/lib/libvirt/dnsmasq/default.conf --leasefile-ro --dhcp-script=/usr/lib/libvirt/libvirt_leaseshelper

[Seth Arnold (seth-arnold)]

dnsmasq's use of 'nobody' has lead to at least https://bugs.launchpad.net/ubuntu/+source/network-manager/+bug/1105493

Thanks

[Christian Ehrhardt  (paelzer)]

Hmm,
not sure why my mailer decided this isn't important - it is!
Lost a few days on it due to not being visible yet - I beg all your pardon for this.
/slap my mail filers

This essentially came due to:
1. myself wanting to bring the Delta we had (by Serge) to run as libvirt-dnsmasq to Debian in [1]
2. out of the discussion in said bug it was decided to be a security risk. I don't have good logs to share (IRC/Mails/Hangout-Talks), but the TL;DR was "do not run it as that user"
3. out of that discussion the change causing this happened in [2]

I think I want to re-fix that at least for bionic to bring back Serges changes.
But in a modified way so they do not trigger the security issues found back then.
They'll probably get an own group at least ...

I also need to look more into the issue that arises due to it for you by reading more into the comments above...

@Seth - any recommendation which user would be best for security isolation. Is an own one (but also with an own group this time) the best we can do?

[1]: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=862340
[2]: https://bugs.launchpad.net/ubuntu/+source/libvirt/+bug/1690729

[Seth Arnold (seth-arnold)]

Thanks Christian, I think you're right that creating a new user account for this service is the way to go. Nice catch from Guido to *not* give libvirt group membership.

[Christian Ehrhardt  (paelzer)]

I looked at bringing back the old Delta, updating it to the new libvirt and fixing up the issues we had in the past:
1. not be part of the livbirt group (worse than user nobody)
2. remove users on purge

I wonder on the group it should get ...
adduser by default for a --system group picks "nogroup".
Is that safe to use, or do we also want/need to create a libvirt-dnsmasq group?

[Christian Ehrhardt  (paelzer)]

I have something prepared that "works" but I'm not really happy.
I'll discuss with Seth on the sprint next week on the options we have on this.

[Christian Ehrhardt  (paelzer)]

A fix for this is queued up for when a few more apparmor issues got an ack upstream so I can deal with them in one upload.

Until that feel free to review [1].
It includes the old code plus:
- creation for an own group (after discussion with Seth on the sprint)
- upgrade from Xenial will fix the old group to the new one
- remove user/group on purge

[1]: https://git.launchpad.net/~libvirt-maintainers/ubuntu/+source/libvirt/commit/?h=ubuntu/bionic-4.0&id=5dfa2589f20cc2f16c8b5d1952272c9e945d84fa

[Seth Arnold (seth-arnold)]

Thanks Christian, this is very nice.

[Launchpad Janitor (janitor)]

This bug was fixed in the package libvirt - 4.0.0-1ubuntu5

---------------
libvirt (4.0.0-1ubuntu5) bionic; urgency=medium

  * run dnsmasq as libvirt-dnsmasq (LP: #1743718)
    - d/libvirt-daemon-system.postinst: add libvirt-dnsmasq user and group
    - d/libvirt-daemon-system.postrm: remove libvirt-dnsmasq user and group on
      purge
    - d/p/ubuntu/dnsmasq-as-priv-user: write dnsmas config with user
      libvirt-dnsmasq and adapt the self tests to expect that config
    - d/libvirt-daemon-system.postinst: fix old libvirt-dnsmasq users
  * Backport from recent upstream to stabilize libvirt (LP: #1754352)
    - d/p/stable/0024-qemu-blockcopy-Add-check-for-bandwidth.patch
    - d/p/stable/0025-conf-move-generated-member-from-virMacAddr-to-virDom.patch
    - d/p/stable/0026-lxc-Drop-useless-check-in-live-device-update.patch
    - d/p/stable/0027-Pass-oldDev-to-virDomainDefCompatibleDevice-on-devic.patch
    - d/p/stable/0028-qemu-Fix-updating-device-with-boot-order.patch
    - d/p/stable/0030-daemon-fix-rpc-event-leak-on-error-path-in-remoteDis.patch
    - d/p/stable/0029-lxc-fix-rpc-event-leak-on-error-path-in-virLXCContro.patch
    - d/p/stable/0031-qemu-fix-memory-leak-of-vporttype-during-migration.patch
    - d/p/stable/0032-virsh-fixing-segfault-by-pool-autocompleter-function.patch
  * d/p/ubuntu-aa/0041-apparmor-add-ro-rule-for-sasl-GSSAPI-
    plugin-on-etc-g.patch fix issues if sasl is configured (LP: #1696471)
  * d/p/ubuntu-aa/0042-virt-aa-helper-resolve-yet-to-be-created-paths.patch
    ensure symlinks are resolved to get valid rules if interim parts of a path
    are a symlink (LP: #1752361)

 -- Christian Ehrhardt <email address hidden> Tue, 27 Feb 2018 12:04:02 +0100