Title: Run DNSMASQ as libvirt-dnsmasq user
DEP: 3
Date: 2012-03-02
Drivers: Serge Hallyn
URL: https://bugs.launchpad.net/ubuntu/+source/libvirt/+bug/938255

Dropped in Artful for security reasons: https://bugs.launchpad.net/ubuntu/+source/libvirt/+bug/1690729
Readded in improved Bionic: https://bugs.launchpad.net/ubuntu/+source/libvirt/+bug/1743718
Debian nack: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=862340

Abstract:
 Generally it's bad form from a security perspective to run daemons as user
 nobody because a vulnerability in one daemon will possibly allow it, when
 compromised, to interfere with another daemon that is also running as nobody.
 The preferred solution is to run it as a service-specific system user. In this
 case, because there may be multiple dnsmasq daemons running, a separate
 libvirt-dnsmasq user (the dnsmasq package itself runs the dnsmasq daemon under
 a system user called unsurprisingly 'dnsmasq').
---
 src/network/bridge_driver.c                                    | 3 ++-
 tests/networkxmlconfdata/bandwidth-network.conf                | 1 +
 tests/networkxmlconfdata/dhcp6-nat-network.conf                | 1 +
 tests/networkxmlconfdata/dhcp6-network.conf                    | 1 +
 tests/networkxmlconfdata/dhcp6host-routed-network.conf         | 1 +
 tests/networkxmlconfdata/dnsmasq-options.conf                  | 1 +
 tests/networkxmlconfdata/isolated-network.conf                 | 1 +
 tests/networkxmlconfdata/leasetime-hours.conf                  | 1 +
 tests/networkxmlconfdata/leasetime-infinite.conf               | 1 +
 tests/networkxmlconfdata/leasetime-minutes.conf                | 1 +
 tests/networkxmlconfdata/leasetime-seconds.conf                | 1 +
 tests/networkxmlconfdata/nat-network-dns-forward-plain.conf    | 1 +
 .../nat-network-dns-forwarder-no-resolv.conf                   | 1 +
 tests/networkxmlconfdata/nat-network-dns-forwarders.conf       | 1 +
 tests/networkxmlconfdata/nat-network-dns-hosts.conf            | 1 +
 tests/networkxmlconfdata/nat-network-dns-local-domain.conf     | 1 +
 .../networkxmlconfdata/nat-network-dns-srv-record-minimal.conf | 1 +
 tests/networkxmlconfdata/nat-network-dns-srv-record.conf       | 1 +
 tests/networkxmlconfdata/nat-network-dns-srv-records.conf      | 1 +
 tests/networkxmlconfdata/nat-network-dns-txt-record.conf       | 1 +
 tests/networkxmlconfdata/nat-network-explicit-flood.conf       | 1 +
 tests/networkxmlconfdata/nat-network-forward-nat-address.conf  | 1 +
 tests/networkxmlconfdata/nat-network-forward-nat-ipv6.conf     | 1 +
 .../networkxmlconfdata/nat-network-forward-nat-no-address.conf | 1 +
 tests/networkxmlconfdata/nat-network-mtu.conf                  | 1 +
 tests/networkxmlconfdata/nat-network-name-with-quotes.conf     | 1 +
 tests/networkxmlconfdata/nat-network.conf                      | 1 +
 tests/networkxmlconfdata/netboot-network.conf                  | 1 +
 tests/networkxmlconfdata/netboot-proxy-network.conf            | 1 +
 tests/networkxmlconfdata/netboot-tftp.conf                     | 1 +
 tests/networkxmlconfdata/open-network.conf                     | 1 +
 tests/networkxmlconfdata/ptr-domains-auto.conf                 | 1 +
 tests/networkxmlconfdata/routed-network.conf                   | 1 +
 tests/networkxmlconfdata/set-mtu.conf                          | 1 +
 34 files changed, 35 insertions(+), 1 deletion(-)

diff --git a/src/network/bridge_driver.c b/src/network/bridge_driver.c
index 4dc3e5424b..2316562826 100644
--- a/src/network/bridge_driver.c
+++ b/src/network/bridge_driver.c
@@ -1187,7 +1187,8 @@ networkDnsmasqConfContents(virNetworkObj *obj,
                       "##    virsh net-edit %s\n"
                       "## or other application using the libvirt API.\n"
                       "##\n## dnsmasq conf file created by libvirt\n"
-                      "strict-order\n",
+                      "strict-order\n"
+                      "user=libvirt-dnsmasq\n",
                       def->name);
 
     /* if dns is disabled, set its listening port to 0, which
diff --git a/tests/networkxmlconfdata/bandwidth-network.conf b/tests/networkxmlconfdata/bandwidth-network.conf
index d45b23ad7a..6291b5926e 100644
--- a/tests/networkxmlconfdata/bandwidth-network.conf
+++ b/tests/networkxmlconfdata/bandwidth-network.conf
@@ -5,6 +5,7 @@
 ##
 ## dnsmasq conf file created by libvirt
 strict-order
+user=libvirt-dnsmasq
 except-interface=lo
 bind-dynamic
 interface=virbr1
diff --git a/tests/networkxmlconfdata/dhcp6-nat-network.conf b/tests/networkxmlconfdata/dhcp6-nat-network.conf
index 536974e508..7df91b825e 100644
--- a/tests/networkxmlconfdata/dhcp6-nat-network.conf
+++ b/tests/networkxmlconfdata/dhcp6-nat-network.conf
@@ -5,6 +5,7 @@
 ##
 ## dnsmasq conf file created by libvirt
 strict-order
+user=libvirt-dnsmasq
 except-interface=lo
 bind-dynamic
 interface=virbr0
diff --git a/tests/networkxmlconfdata/dhcp6-network.conf b/tests/networkxmlconfdata/dhcp6-network.conf
index 82706903b3..38f1690ceb 100644
--- a/tests/networkxmlconfdata/dhcp6-network.conf
+++ b/tests/networkxmlconfdata/dhcp6-network.conf
@@ -5,6 +5,7 @@
 ##
 ## dnsmasq conf file created by libvirt
 strict-order
+user=libvirt-dnsmasq
 domain=mynet
 expand-hosts
 except-interface=lo
diff --git a/tests/networkxmlconfdata/dhcp6host-routed-network.conf b/tests/networkxmlconfdata/dhcp6host-routed-network.conf
index 87a1498809..e62211a56c 100644
--- a/tests/networkxmlconfdata/dhcp6host-routed-network.conf
+++ b/tests/networkxmlconfdata/dhcp6host-routed-network.conf
@@ -5,6 +5,7 @@
 ##
 ## dnsmasq conf file created by libvirt
 strict-order
+user=libvirt-dnsmasq
 except-interface=lo
 bind-dynamic
 interface=virbr1
diff --git a/tests/networkxmlconfdata/dnsmasq-options.conf b/tests/networkxmlconfdata/dnsmasq-options.conf
index 867f355c79..dfa4a54c25 100644
--- a/tests/networkxmlconfdata/dnsmasq-options.conf
+++ b/tests/networkxmlconfdata/dnsmasq-options.conf
@@ -5,6 +5,7 @@
 ##
 ## dnsmasq conf file created by libvirt
 strict-order
+user=libvirt-dnsmasq
 except-interface=lo
 bind-dynamic
 interface=virbr0
diff --git a/tests/networkxmlconfdata/isolated-network.conf b/tests/networkxmlconfdata/isolated-network.conf
index ea66bb83e6..32b599b480 100644
--- a/tests/networkxmlconfdata/isolated-network.conf
+++ b/tests/networkxmlconfdata/isolated-network.conf
@@ -5,6 +5,7 @@
 ##
 ## dnsmasq conf file created by libvirt
 strict-order
+user=libvirt-dnsmasq
 except-interface=lo
 bind-dynamic
 interface=virbr2
diff --git a/tests/networkxmlconfdata/leasetime-hours.conf b/tests/networkxmlconfdata/leasetime-hours.conf
index 1599d4633e..5d4f76a5c7 100644
--- a/tests/networkxmlconfdata/leasetime-hours.conf
+++ b/tests/networkxmlconfdata/leasetime-hours.conf
@@ -5,6 +5,7 @@
 ##
 ## dnsmasq conf file created by libvirt
 strict-order
+user=libvirt-dnsmasq
 except-interface=lo
 bind-dynamic
 interface=virbr0
diff --git a/tests/networkxmlconfdata/leasetime-infinite.conf b/tests/networkxmlconfdata/leasetime-infinite.conf
index 883ced6ade..423b76ca9f 100644
--- a/tests/networkxmlconfdata/leasetime-infinite.conf
+++ b/tests/networkxmlconfdata/leasetime-infinite.conf
@@ -5,6 +5,7 @@
 ##
 ## dnsmasq conf file created by libvirt
 strict-order
+user=libvirt-dnsmasq
 except-interface=lo
 bind-dynamic
 interface=virbr0
diff --git a/tests/networkxmlconfdata/leasetime-minutes.conf b/tests/networkxmlconfdata/leasetime-minutes.conf
index c093501a35..0f474962e3 100644
--- a/tests/networkxmlconfdata/leasetime-minutes.conf
+++ b/tests/networkxmlconfdata/leasetime-minutes.conf
@@ -5,6 +5,7 @@
 ##
 ## dnsmasq conf file created by libvirt
 strict-order
+user=libvirt-dnsmasq
 except-interface=lo
 bind-dynamic
 interface=virbr0
diff --git a/tests/networkxmlconfdata/leasetime-seconds.conf b/tests/networkxmlconfdata/leasetime-seconds.conf
index 8b2a81c308..f844f6409a 100644
--- a/tests/networkxmlconfdata/leasetime-seconds.conf
+++ b/tests/networkxmlconfdata/leasetime-seconds.conf
@@ -5,6 +5,7 @@
 ##
 ## dnsmasq conf file created by libvirt
 strict-order
+user=libvirt-dnsmasq
 except-interface=lo
 bind-dynamic
 interface=virbr0
diff --git a/tests/networkxmlconfdata/nat-network-dns-forward-plain.conf b/tests/networkxmlconfdata/nat-network-dns-forward-plain.conf
index 9a000b8879..97c0435ca6 100644
--- a/tests/networkxmlconfdata/nat-network-dns-forward-plain.conf
+++ b/tests/networkxmlconfdata/nat-network-dns-forward-plain.conf
@@ -5,6 +5,7 @@
 ##
 ## dnsmasq conf file created by libvirt
 strict-order
+user=libvirt-dnsmasq
 except-interface=lo
 bind-dynamic
 interface=virbr0
diff --git a/tests/networkxmlconfdata/nat-network-dns-forwarder-no-resolv.conf b/tests/networkxmlconfdata/nat-network-dns-forwarder-no-resolv.conf
index 52d000aa0f..d80b6f6d0f 100644
--- a/tests/networkxmlconfdata/nat-network-dns-forwarder-no-resolv.conf
+++ b/tests/networkxmlconfdata/nat-network-dns-forwarder-no-resolv.conf
@@ -5,6 +5,7 @@
 ##
 ## dnsmasq conf file created by libvirt
 strict-order
+user=libvirt-dnsmasq
 server=/example.com/192.168.1.1
 except-interface=lo
 bind-dynamic
diff --git a/tests/networkxmlconfdata/nat-network-dns-forwarders.conf b/tests/networkxmlconfdata/nat-network-dns-forwarders.conf
index fcaf7e70e8..7627ae6e7d 100644
--- a/tests/networkxmlconfdata/nat-network-dns-forwarders.conf
+++ b/tests/networkxmlconfdata/nat-network-dns-forwarders.conf
@@ -5,6 +5,7 @@
 ##
 ## dnsmasq conf file created by libvirt
 strict-order
+user=libvirt-dnsmasq
 server=8.8.8.8
 server=8.8.4.4
 server=/example.com/192.168.1.1
diff --git a/tests/networkxmlconfdata/nat-network-dns-hosts.conf b/tests/networkxmlconfdata/nat-network-dns-hosts.conf
index 021316f9c7..15b668aa0e 100644
--- a/tests/networkxmlconfdata/nat-network-dns-hosts.conf
+++ b/tests/networkxmlconfdata/nat-network-dns-hosts.conf
@@ -5,6 +5,7 @@
 ##
 ## dnsmasq conf file created by libvirt
 strict-order
+user=libvirt-dnsmasq
 domain=example.com
 expand-hosts
 domain-needed
diff --git a/tests/networkxmlconfdata/nat-network-dns-local-domain.conf b/tests/networkxmlconfdata/nat-network-dns-local-domain.conf
index 5f41b9186c..d48609b257 100644
--- a/tests/networkxmlconfdata/nat-network-dns-local-domain.conf
+++ b/tests/networkxmlconfdata/nat-network-dns-local-domain.conf
@@ -5,6 +5,7 @@
 ##
 ## dnsmasq conf file created by libvirt
 strict-order
+user=libvirt-dnsmasq
 local=/example.com/
 domain=example.com
 expand-hosts
diff --git a/tests/networkxmlconfdata/nat-network-dns-srv-record-minimal.conf b/tests/networkxmlconfdata/nat-network-dns-srv-record-minimal.conf
index 4757f824da..7e7ed0eb33 100644
--- a/tests/networkxmlconfdata/nat-network-dns-srv-record-minimal.conf
+++ b/tests/networkxmlconfdata/nat-network-dns-srv-record-minimal.conf
@@ -5,6 +5,7 @@
 ##
 ## dnsmasq conf file created by libvirt
 strict-order
+user=libvirt-dnsmasq
 except-interface=lo
 bind-dynamic
 interface=virbr0
diff --git a/tests/networkxmlconfdata/nat-network-dns-srv-record.conf b/tests/networkxmlconfdata/nat-network-dns-srv-record.conf
index c83148cc0a..690934b171 100644
--- a/tests/networkxmlconfdata/nat-network-dns-srv-record.conf
+++ b/tests/networkxmlconfdata/nat-network-dns-srv-record.conf
@@ -5,6 +5,7 @@
 ##
 ## dnsmasq conf file created by libvirt
 strict-order
+user=libvirt-dnsmasq
 except-interface=lo
 bind-dynamic
 interface=virbr0
diff --git a/tests/networkxmlconfdata/nat-network-dns-srv-records.conf b/tests/networkxmlconfdata/nat-network-dns-srv-records.conf
index b85eb85af3..be1263f92b 100644
--- a/tests/networkxmlconfdata/nat-network-dns-srv-records.conf
+++ b/tests/networkxmlconfdata/nat-network-dns-srv-records.conf
@@ -5,6 +5,7 @@
 ##
 ## dnsmasq conf file created by libvirt
 strict-order
+user=libvirt-dnsmasq
 except-interface=lo
 bind-dynamic
 interface=virbr0
diff --git a/tests/networkxmlconfdata/nat-network-dns-txt-record.conf b/tests/networkxmlconfdata/nat-network-dns-txt-record.conf
index d9b981a6e5..ae1f4195d2 100644
--- a/tests/networkxmlconfdata/nat-network-dns-txt-record.conf
+++ b/tests/networkxmlconfdata/nat-network-dns-txt-record.conf
@@ -5,6 +5,7 @@
 ##
 ## dnsmasq conf file created by libvirt
 strict-order
+user=libvirt-dnsmasq
 except-interface=lo
 bind-dynamic
 interface=virbr0
diff --git a/tests/networkxmlconfdata/nat-network-explicit-flood.conf b/tests/networkxmlconfdata/nat-network-explicit-flood.conf
index 873a360acc..6c23f9a19f 100644
--- a/tests/networkxmlconfdata/nat-network-explicit-flood.conf
+++ b/tests/networkxmlconfdata/nat-network-explicit-flood.conf
@@ -5,6 +5,7 @@
 ##
 ## dnsmasq conf file created by libvirt
 strict-order
+user=libvirt-dnsmasq
 except-interface=lo
 bind-dynamic
 interface=virbr0
diff --git a/tests/networkxmlconfdata/nat-network-forward-nat-address.conf b/tests/networkxmlconfdata/nat-network-forward-nat-address.conf
index 873a360acc..6c23f9a19f 100644
--- a/tests/networkxmlconfdata/nat-network-forward-nat-address.conf
+++ b/tests/networkxmlconfdata/nat-network-forward-nat-address.conf
@@ -5,6 +5,7 @@
 ##
 ## dnsmasq conf file created by libvirt
 strict-order
+user=libvirt-dnsmasq
 except-interface=lo
 bind-dynamic
 interface=virbr0
diff --git a/tests/networkxmlconfdata/nat-network-forward-nat-ipv6.conf b/tests/networkxmlconfdata/nat-network-forward-nat-ipv6.conf
index 3627bbaf1d..fa6562d230 100644
--- a/tests/networkxmlconfdata/nat-network-forward-nat-ipv6.conf
+++ b/tests/networkxmlconfdata/nat-network-forward-nat-ipv6.conf
@@ -5,6 +5,7 @@
 ##
 ## dnsmasq conf file created by libvirt
 strict-order
+user=libvirt-dnsmasq
 except-interface=lo
 bind-dynamic
 interface=virbr0
diff --git a/tests/networkxmlconfdata/nat-network-forward-nat-no-address.conf b/tests/networkxmlconfdata/nat-network-forward-nat-no-address.conf
index 873a360acc..6c23f9a19f 100644
--- a/tests/networkxmlconfdata/nat-network-forward-nat-no-address.conf
+++ b/tests/networkxmlconfdata/nat-network-forward-nat-no-address.conf
@@ -5,6 +5,7 @@
 ##
 ## dnsmasq conf file created by libvirt
 strict-order
+user=libvirt-dnsmasq
 except-interface=lo
 bind-dynamic
 interface=virbr0
diff --git a/tests/networkxmlconfdata/nat-network-mtu.conf b/tests/networkxmlconfdata/nat-network-mtu.conf
index 1dd4754f2a..ffa5fe6ff7 100644
--- a/tests/networkxmlconfdata/nat-network-mtu.conf
+++ b/tests/networkxmlconfdata/nat-network-mtu.conf
@@ -5,6 +5,7 @@
 ##
 ## dnsmasq conf file created by libvirt
 strict-order
+user=libvirt-dnsmasq
 except-interface=lo
 bind-dynamic
 interface=virbr0
diff --git a/tests/networkxmlconfdata/nat-network-name-with-quotes.conf b/tests/networkxmlconfdata/nat-network-name-with-quotes.conf
index 5c5ea7b48e..fa5d4ffe62 100644
--- a/tests/networkxmlconfdata/nat-network-name-with-quotes.conf
+++ b/tests/networkxmlconfdata/nat-network-name-with-quotes.conf
@@ -5,6 +5,7 @@
 ##
 ## dnsmasq conf file created by libvirt
 strict-order
+user=libvirt-dnsmasq
 except-interface=lo
 bind-dynamic
 interface=virbr0
diff --git a/tests/networkxmlconfdata/nat-network.conf b/tests/networkxmlconfdata/nat-network.conf
index 873a360acc..6c23f9a19f 100644
--- a/tests/networkxmlconfdata/nat-network.conf
+++ b/tests/networkxmlconfdata/nat-network.conf
@@ -5,6 +5,7 @@
 ##
 ## dnsmasq conf file created by libvirt
 strict-order
+user=libvirt-dnsmasq
 except-interface=lo
 bind-dynamic
 interface=virbr0
diff --git a/tests/networkxmlconfdata/netboot-network.conf b/tests/networkxmlconfdata/netboot-network.conf
index 32ef25b05f..caec6e6e24 100644
--- a/tests/networkxmlconfdata/netboot-network.conf
+++ b/tests/networkxmlconfdata/netboot-network.conf
@@ -5,6 +5,7 @@
 ##
 ## dnsmasq conf file created by libvirt
 strict-order
+user=libvirt-dnsmasq
 domain=example.com
 expand-hosts
 except-interface=lo
diff --git a/tests/networkxmlconfdata/netboot-proxy-network.conf b/tests/networkxmlconfdata/netboot-proxy-network.conf
index 280da323e2..ddd6445839 100644
--- a/tests/networkxmlconfdata/netboot-proxy-network.conf
+++ b/tests/networkxmlconfdata/netboot-proxy-network.conf
@@ -5,6 +5,7 @@
 ##
 ## dnsmasq conf file created by libvirt
 strict-order
+user=libvirt-dnsmasq
 domain=example.com
 expand-hosts
 except-interface=lo
diff --git a/tests/networkxmlconfdata/netboot-tftp.conf b/tests/networkxmlconfdata/netboot-tftp.conf
index 45615f3c33..f92809c6b7 100644
--- a/tests/networkxmlconfdata/netboot-tftp.conf
+++ b/tests/networkxmlconfdata/netboot-tftp.conf
@@ -5,6 +5,7 @@
 ##
 ## dnsmasq conf file created by libvirt
 strict-order
+user=libvirt-dnsmasq
 except-interface=lo
 bind-dynamic
 interface=virbr0
diff --git a/tests/networkxmlconfdata/open-network.conf b/tests/networkxmlconfdata/open-network.conf
index ff099847d4..0b221aa5a6 100644
--- a/tests/networkxmlconfdata/open-network.conf
+++ b/tests/networkxmlconfdata/open-network.conf
@@ -5,6 +5,7 @@
 ##
 ## dnsmasq conf file created by libvirt
 strict-order
+user=libvirt-dnsmasq
 except-interface=lo
 bind-dynamic
 interface=virbr1
diff --git a/tests/networkxmlconfdata/ptr-domains-auto.conf b/tests/networkxmlconfdata/ptr-domains-auto.conf
index 86701c4ddf..ddc0b43e1a 100644
--- a/tests/networkxmlconfdata/ptr-domains-auto.conf
+++ b/tests/networkxmlconfdata/ptr-domains-auto.conf
@@ -5,6 +5,7 @@
 ##
 ## dnsmasq conf file created by libvirt
 strict-order
+user=libvirt-dnsmasq
 local=/122.168.192.in-addr.arpa/
 local=/1.0.e.f.0.1.c.a.8.b.d.0.1.0.0.2.ip6.arpa/
 except-interface=lo
diff --git a/tests/networkxmlconfdata/routed-network.conf b/tests/networkxmlconfdata/routed-network.conf
index 970aa3cd35..caffaee2aa 100644
--- a/tests/networkxmlconfdata/routed-network.conf
+++ b/tests/networkxmlconfdata/routed-network.conf
@@ -5,6 +5,7 @@
 ##
 ## dnsmasq conf file created by libvirt
 strict-order
+user=libvirt-dnsmasq
 except-interface=lo
 bind-dynamic
 interface=virbr1
diff --git a/tests/networkxmlconfdata/set-mtu.conf b/tests/networkxmlconfdata/set-mtu.conf
index 011a288a5b..955f03db67 100644
--- a/tests/networkxmlconfdata/set-mtu.conf
+++ b/tests/networkxmlconfdata/set-mtu.conf
@@ -5,6 +5,7 @@
 ##
 ## dnsmasq conf file created by libvirt
 strict-order
+user=libvirt-dnsmasq
 except-interface=lo
 bind-dynamic
 interface=virbr2
-- 
2.43.0

