a565fea565
The local_open2() callback is vulnerable to symlink attacks because it calls: (1) open() which follows symbolic links for all path elements but the rightmost one (2) local_set_xattr()->setxattr() which follows symbolic links for all path elements (3) local_set_mapped_file_attr() which calls in turn local_fopen() and mkdir(), both functions following symbolic links for all path elements but the rightmost one (4) local_post_create_passthrough() which calls in turn lchown() and chmod(), both functions also following symbolic links This patch converts local_open2() to rely on opendir_nofollow() and mkdirat() to fix (1), as well as local_set_xattrat(), local_set_mapped_file_attrat() and local_set_cred_passthrough() to fix (2), (3) and (4) respectively. Since local_open2() already opens a descriptor to the target file, local_set_cred_passthrough() is modified to reuse it instead of opening a new one. The mapped and mapped-file security modes are supposed to be identical, except for the place where credentials and file modes are stored. While here, we also make that explicit by sharing the call to openat(). This partly fixes CVE-2016-9602. Signed-off-by: Greg Kurz <groug@kaod.org> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> |
||
---|---|---|
.. | ||
9p-handle.c | ||
9p-local.c | ||
9p-local.h | ||
9p-posix-acl.c | ||
9p-proxy.c | ||
9p-proxy.h | ||
9p-synth.c | ||
9p-synth.h | ||
9p-util.c | ||
9p-util.h | ||
9p-xattr-user.c | ||
9p-xattr.c | ||
9p-xattr.h | ||
9p.c | ||
9p.h | ||
codir.c | ||
cofile.c | ||
cofs.c | ||
coth.c | ||
coth.h | ||
coxattr.c | ||
Makefile.objs | ||
trace-events | ||
virtio-9p-device.c | ||
virtio-9p.h |