Re: qemu-user viability (was Re: [SECURITY] [DSA 5983-1] qemu security update)

2025-09-03 Thread Geert Uytterhoeven
Hi Rob, #off-topic On Sun, 24 Aug 2025 at 20:40, Rob Landley wrote: > Anyway, this works fine on little endian, but the qemu-system-sh4eb > build has something hinky in the ethernet, I haven't tackled it myself > because I don't know whether the device emulation or the driver is > what's missing

Re: qemu-user viability (was Re: [SECURITY] [DSA 5983-1] qemu security update)

2025-08-24 Thread Rob Landley
On 8/23/25 09:19, Thorsten Glaser wrote: There are no alternatives - qemu is unique in this regard. And it has never been designed for this usage. What we had for 15+ years, unnoticed, is like `chmod u+s /bin/sh`, which is never supposed to be used like this. Perhaps, but there’s shades in be

Re: qemu-user viability (was Re: [SECURITY] [DSA 5983-1] qemu security update)

2025-08-23 Thread Bastian Blank
On Sat, Aug 23, 2025 at 04:19:29PM +0200, Thorsten Glaser wrote: > On Sat, 23 Aug 2025, Michael Tokarev wrote: > > >> Does this entirely break things like running sudo within a > >> qemu-user-emulated chroot (or buildd/cowbuilder/schroot)? > > > It discontinues elevating (changing) privileges usi

Re: qemu-user viability

2025-08-23 Thread Michael Tokarev
On 23.08.2025 21:17, Thorsten Glaser wrote: On Sat, 23 Aug 2025, Michael Tokarev wrote: What are we talking about? I don't understand. About this: Can you read my whole question instead of just the top of it? This is impolite when you skip whole my explanation. prompt> chroot --userspec=

Re: qemu-user viability

2025-08-23 Thread Thorsten Glaser
On Sat, 23 Aug 2025, Michael Tokarev wrote: > What are we talking about? I don't understand. About this: prompt> chroot --userspec=uname:gname /path/to/chroot /bin/sh chroot> do something chroot> sudo do something else […] chroot> exit What part of that ↑ precisely do you not understand? And

Re: qemu-user viability (was Re: [SECURITY] [DSA 5983-1] qemu security update)

2025-08-23 Thread Michael Tokarev
Please, everyone, tell me. Suppose we had suid-root /bin/sh for 15 years. We noticed this and removed the suid bit from it, finally - because this way everyone's system was trivially vulnerable to a trivial local root - there isn't even "exploit" necessary, just run /bin/sh and be root. Now you

Re: qemu-user viability (was Re: [SECURITY] [DSA 5983-1] qemu security update)

2025-08-23 Thread John Paul Adrian Glaubitz
On Sat, 2025-08-23 at 16:19 +0200, Thorsten Glaser wrote: > (Cc porters, for the arches where some buildds use qemu-user) Removing debian-po...@lists.debian.org again and using debian-68k@lists.debian.org and debian-sup...@lists.debian.org instead as to not spam all ports mailing lists. > On Sa

qemu-user viability (was Re: [SECURITY] [DSA 5983-1] qemu security update)

2025-08-23 Thread Thorsten Glaser
(Cc porters, for the arches where some buildds use qemu-user) On Sat, 23 Aug 2025, Michael Tokarev wrote: >> Does this entirely break things like running sudo within a >> qemu-user-emulated chroot (or buildd/cowbuilder/schroot)? > It discontinues elevating (changing) privileges using qemu-user b