mirrors
/
qemu
mirror of https://gitlab.com/qemu-project/qemu
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

9pfs: local: link: don't follow symlinks 

The local_link() callback is vulnerable to symlink attacks because it calls:

(1) link() which follows symbolic links for all path elements but the
    rightmost one
(2) local_create_mapped_attr_dir()->mkdir() which follows symbolic links
    for all path elements but the rightmost one

This patch converts local_link() to rely on opendir_nofollow() and linkat()
to fix (1), mkdirat() to fix (2).

This partly fixes CVE-2016-9602.

Signed-off-by: Greg Kurz <groug@kaod.org>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
This commit is contained in:
Greg Kurz 2017-02-26 23:44:20 +01:00
parent 6dd4b1f1d0
commit ad0b46e6ac
1 changed files with 57 additions and 31 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

88
hw/9pfs/9p-local.c
View File

@ -75,6 +75,13 @@ static void renameat_preserve_errno(int odirfd, const char *opath, int ndirfd,
errno = serrno; errno = serrno;
} }
static void unlinkat_preserve_errno(int dirfd, const char *path, int flags)
{
int serrno = errno;
unlinkat(dirfd, path, flags);
errno = serrno;
}
#define VIRTFS_META_DIR ".virtfs_metadata" #define VIRTFS_META_DIR ".virtfs_metadata"
static char *local_mapped_attr_path(FsContext *ctx, const char *path) static char *local_mapped_attr_path(FsContext *ctx, const char *path)
@ -917,49 +924,68 @@ out:
static int local_link(FsContext *ctx, V9fsPath *oldpath, static int local_link(FsContext *ctx, V9fsPath *oldpath,
V9fsPath *dirpath, const char *name) V9fsPath *dirpath, const char *name)
{ {
int ret; char *odirpath = g_path_get_dirname(oldpath->data);
V9fsString newpath; char *oname = g_path_get_basename(oldpath->data);
char *buffer, *buffer1; int ret = -1;
int serrno; int odirfd, ndirfd;
v9fs_string_init(&newpath); odirfd = local_opendir_nofollow(ctx, odirpath);
v9fs_string_sprintf(&newpath, "%s/%s", dirpath->data, name); if (odirfd == -1) {
buffer = rpath(ctx, oldpath->data);
buffer1 = rpath(ctx, newpath.data);
ret = link(buffer, buffer1);
g_free(buffer);
if (ret < 0) {
goto out; goto out;
} }
ndirfd = local_opendir_nofollow(ctx, dirpath->data);
if (ndirfd == -1) {
close_preserve_errno(odirfd);
goto out;
}
ret = linkat(odirfd, oname, ndirfd, name, 0);
if (ret < 0) {
goto out_close;
}
/* now link the virtfs_metadata files */ /* now link the virtfs_metadata files */
if (ctx->export_flags & V9FS_SM_MAPPED_FILE) { if (ctx->export_flags & V9FS_SM_MAPPED_FILE) {
char *vbuffer, *vbuffer1; int omap_dirfd, nmap_dirfd;
/* Link the .virtfs_metadata files. Create the metada directory */ ret = mkdirat(ndirfd, VIRTFS_META_DIR, 0700);
ret = local_create_mapped_attr_dir(ctx, newpath.data); if (ret < 0 && errno != EEXIST) {
if (ret < 0) { goto err_undo_link;
goto err_out;
} }
vbuffer = local_mapped_attr_path(ctx, oldpath->data);
vbuffer1 = local_mapped_attr_path(ctx, newpath.data); omap_dirfd = openat_dir(odirfd, VIRTFS_META_DIR);
ret = link(vbuffer, vbuffer1); if (omap_dirfd == -1) {
g_free(vbuffer); goto err;
g_free(vbuffer1); }
nmap_dirfd = openat_dir(ndirfd, VIRTFS_META_DIR);
if (nmap_dirfd == -1) {
close_preserve_errno(omap_dirfd);
goto err;
}
ret = linkat(omap_dirfd, oname, nmap_dirfd, name, 0);
close_preserve_errno(nmap_dirfd);
close_preserve_errno(omap_dirfd);
if (ret < 0 && errno != ENOENT) { if (ret < 0 && errno != ENOENT) {
goto err_out; goto err_undo_link;
} }
}
goto out;
err_out: ret = 0;
serrno = errno; }
remove(buffer1); goto out_close;
errno = serrno;
err:
ret = -1;
err_undo_link:
unlinkat_preserve_errno(ndirfd, name, 0);
out_close:
close_preserve_errno(ndirfd);
close_preserve_errno(odirfd);
out: out:
g_free(buffer1); g_free(oname);
v9fs_string_free(&newpath); g_free(odirpath);
return ret; return ret;
} }