mirror of https://gitlab.com/qemu-project/qemu
9pfs: local: lgetxattr: don't follow symlinks
The local_lgetxattr() callback is vulnerable to symlink attacks because it calls lgetxattr() which follows symbolic links in all path elements but the rightmost one. This patch introduces a helper to emulate the non-existing fgetxattrat() function: it is implemented with /proc/self/fd which provides a trusted path that can be safely passed to lgetxattr(). local_lgetxattr() is converted to use this helper and opendir_nofollow(). This partly fixes CVE-2016-9602. Signed-off-by: Greg Kurz <groug@kaod.org> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
This commit is contained in:
parent
996a0d76d7
commit
56ad3e54da
|
@ -25,13 +25,7 @@
|
||||||
static ssize_t mp_pacl_getxattr(FsContext *ctx, const char *path,
|
static ssize_t mp_pacl_getxattr(FsContext *ctx, const char *path,
|
||||||
const char *name, void *value, size_t size)
|
const char *name, void *value, size_t size)
|
||||||
{
|
{
|
||||||
char *buffer;
|
return local_getxattr_nofollow(ctx, path, MAP_ACL_ACCESS, value, size);
|
||||||
ssize_t ret;
|
|
||||||
|
|
||||||
buffer = rpath(ctx, path);
|
|
||||||
ret = lgetxattr(buffer, MAP_ACL_ACCESS, value, size);
|
|
||||||
g_free(buffer);
|
|
||||||
return ret;
|
|
||||||
}
|
}
|
||||||
|
|
||||||
static ssize_t mp_pacl_listxattr(FsContext *ctx, const char *path,
|
static ssize_t mp_pacl_listxattr(FsContext *ctx, const char *path,
|
||||||
|
@ -89,13 +83,7 @@ static int mp_pacl_removexattr(FsContext *ctx,
|
||||||
static ssize_t mp_dacl_getxattr(FsContext *ctx, const char *path,
|
static ssize_t mp_dacl_getxattr(FsContext *ctx, const char *path,
|
||||||
const char *name, void *value, size_t size)
|
const char *name, void *value, size_t size)
|
||||||
{
|
{
|
||||||
char *buffer;
|
return local_getxattr_nofollow(ctx, path, MAP_ACL_DEFAULT, value, size);
|
||||||
ssize_t ret;
|
|
||||||
|
|
||||||
buffer = rpath(ctx, path);
|
|
||||||
ret = lgetxattr(buffer, MAP_ACL_DEFAULT, value, size);
|
|
||||||
g_free(buffer);
|
|
||||||
return ret;
|
|
||||||
}
|
}
|
||||||
|
|
||||||
static ssize_t mp_dacl_listxattr(FsContext *ctx, const char *path,
|
static ssize_t mp_dacl_listxattr(FsContext *ctx, const char *path,
|
||||||
|
|
|
@ -11,6 +11,7 @@
|
||||||
*/
|
*/
|
||||||
|
|
||||||
#include "qemu/osdep.h"
|
#include "qemu/osdep.h"
|
||||||
|
#include "qemu/xattr.h"
|
||||||
#include "9p-util.h"
|
#include "9p-util.h"
|
||||||
|
|
||||||
int relative_openat_nofollow(int dirfd, const char *path, int flags,
|
int relative_openat_nofollow(int dirfd, const char *path, int flags,
|
||||||
|
@ -55,3 +56,14 @@ int relative_openat_nofollow(int dirfd, const char *path, int flags,
|
||||||
|
|
||||||
return fd;
|
return fd;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
ssize_t fgetxattrat_nofollow(int dirfd, const char *filename, const char *name,
|
||||||
|
void *value, size_t size)
|
||||||
|
{
|
||||||
|
char *proc_path = g_strdup_printf("/proc/self/fd/%d/%s", dirfd, filename);
|
||||||
|
int ret;
|
||||||
|
|
||||||
|
ret = lgetxattr(proc_path, name, value, size);
|
||||||
|
g_free(proc_path);
|
||||||
|
return ret;
|
||||||
|
}
|
||||||
|
|
|
@ -46,5 +46,7 @@ static inline int openat_file(int dirfd, const char *name, int flags,
|
||||||
|
|
||||||
int relative_openat_nofollow(int dirfd, const char *path, int flags,
|
int relative_openat_nofollow(int dirfd, const char *path, int flags,
|
||||||
mode_t mode);
|
mode_t mode);
|
||||||
|
ssize_t fgetxattrat_nofollow(int dirfd, const char *path, const char *name,
|
||||||
|
void *value, size_t size);
|
||||||
|
|
||||||
#endif
|
#endif
|
||||||
|
|
|
@ -20,9 +20,6 @@
|
||||||
static ssize_t mp_user_getxattr(FsContext *ctx, const char *path,
|
static ssize_t mp_user_getxattr(FsContext *ctx, const char *path,
|
||||||
const char *name, void *value, size_t size)
|
const char *name, void *value, size_t size)
|
||||||
{
|
{
|
||||||
char *buffer;
|
|
||||||
ssize_t ret;
|
|
||||||
|
|
||||||
if (strncmp(name, "user.virtfs.", 12) == 0) {
|
if (strncmp(name, "user.virtfs.", 12) == 0) {
|
||||||
/*
|
/*
|
||||||
* Don't allow fetch of user.virtfs namesapce
|
* Don't allow fetch of user.virtfs namesapce
|
||||||
|
@ -31,10 +28,7 @@ static ssize_t mp_user_getxattr(FsContext *ctx, const char *path,
|
||||||
errno = ENOATTR;
|
errno = ENOATTR;
|
||||||
return -1;
|
return -1;
|
||||||
}
|
}
|
||||||
buffer = rpath(ctx, path);
|
return local_getxattr_nofollow(ctx, path, name, value, size);
|
||||||
ret = lgetxattr(buffer, name, value, size);
|
|
||||||
g_free(buffer);
|
|
||||||
return ret;
|
|
||||||
}
|
}
|
||||||
|
|
||||||
static ssize_t mp_user_listxattr(FsContext *ctx, const char *path,
|
static ssize_t mp_user_listxattr(FsContext *ctx, const char *path,
|
||||||
|
|
|
@ -15,6 +15,8 @@
|
||||||
#include "9p.h"
|
#include "9p.h"
|
||||||
#include "fsdev/file-op-9p.h"
|
#include "fsdev/file-op-9p.h"
|
||||||
#include "9p-xattr.h"
|
#include "9p-xattr.h"
|
||||||
|
#include "9p-util.h"
|
||||||
|
#include "9p-local.h"
|
||||||
|
|
||||||
|
|
||||||
static XattrOperations *get_xattr_operations(XattrOperations **h,
|
static XattrOperations *get_xattr_operations(XattrOperations **h,
|
||||||
|
@ -143,16 +145,31 @@ int v9fs_remove_xattr(FsContext *ctx,
|
||||||
|
|
||||||
}
|
}
|
||||||
|
|
||||||
|
ssize_t local_getxattr_nofollow(FsContext *ctx, const char *path,
|
||||||
|
const char *name, void *value, size_t size)
|
||||||
|
{
|
||||||
|
char *dirpath = g_path_get_dirname(path);
|
||||||
|
char *filename = g_path_get_basename(path);
|
||||||
|
int dirfd;
|
||||||
|
ssize_t ret = -1;
|
||||||
|
|
||||||
|
dirfd = local_opendir_nofollow(ctx, dirpath);
|
||||||
|
if (dirfd == -1) {
|
||||||
|
goto out;
|
||||||
|
}
|
||||||
|
|
||||||
|
ret = fgetxattrat_nofollow(dirfd, filename, name, value, size);
|
||||||
|
close_preserve_errno(dirfd);
|
||||||
|
out:
|
||||||
|
g_free(dirpath);
|
||||||
|
g_free(filename);
|
||||||
|
return ret;
|
||||||
|
}
|
||||||
|
|
||||||
ssize_t pt_getxattr(FsContext *ctx, const char *path, const char *name,
|
ssize_t pt_getxattr(FsContext *ctx, const char *path, const char *name,
|
||||||
void *value, size_t size)
|
void *value, size_t size)
|
||||||
{
|
{
|
||||||
char *buffer;
|
return local_getxattr_nofollow(ctx, path, name, value, size);
|
||||||
ssize_t ret;
|
|
||||||
|
|
||||||
buffer = rpath(ctx, path);
|
|
||||||
ret = lgetxattr(buffer, name, value, size);
|
|
||||||
g_free(buffer);
|
|
||||||
return ret;
|
|
||||||
}
|
}
|
||||||
|
|
||||||
int pt_setxattr(FsContext *ctx, const char *path, const char *name, void *value,
|
int pt_setxattr(FsContext *ctx, const char *path, const char *name, void *value,
|
||||||
|
|
|
@ -29,6 +29,8 @@ typedef struct xattr_operations
|
||||||
const char *path, const char *name);
|
const char *path, const char *name);
|
||||||
} XattrOperations;
|
} XattrOperations;
|
||||||
|
|
||||||
|
ssize_t local_getxattr_nofollow(FsContext *ctx, const char *path,
|
||||||
|
const char *name, void *value, size_t size);
|
||||||
|
|
||||||
extern XattrOperations mapped_user_xattr;
|
extern XattrOperations mapped_user_xattr;
|
||||||
extern XattrOperations passthrough_user_xattr;
|
extern XattrOperations passthrough_user_xattr;
|
||||||
|
|
Loading…
Reference in New Issue