qemu/docs/tools
Dr. David Alan Gilbert e586edcb41 virtiofs: drop remapped security.capability xattr as needed
On Linux, the 'security.capability' xattr holds a set of
capabilities that can change when an executable is run, giving
a limited form of privilege escalation to those programs that
the writer of the file deemed worthy.

Any write causes the 'security.capability' xattr to be dropped,
stopping anyone from gaining privilege by modifying a blessed
file.

Fuse relies on the daemon to do this dropping, and in turn the
daemon relies on the host kernel to drop the xattr for it.  However,
with the addition of -o xattrmap, the xattr that the guest
stores its capabilities in is now not the same as the one that
the host kernel automatically clears.

Where the mapping changes 'security.capability', explicitly clear
the remapped name to preserve the same behaviour.

This bug is assigned CVE-2021-20263.

Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Reviewed-by: Vivek Goyal <vgoyal@redhat.com>
2021-03-04 10:26:16 +00:00
..
_templates docs: add "page source" link to sphinx documentation 2020-11-10 08:51:30 +01:00
index.rst docs: add qemu-storage-daemon(1) man page 2020-12-18 11:48:39 +01:00
qemu-img.rst qemu-img: add support for rate limit in qemu-img convert 2020-10-27 15:26:20 +01:00
qemu-nbd.rst qemu-nbd: Permit --shared=0 for unlimited clients 2021-02-12 07:42:08 -06:00
qemu-pr-helper.rst docs: Split qemu-pr-helper documentation into tools manual 2020-11-23 11:10:04 +00:00
qemu-storage-daemon.rst docs: update to show preferred boolean syntax for -chardev 2021-02-25 14:14:33 +01:00
qemu-trace-stap.rst docs: Move tools documentation to tools manual 2020-02-25 10:48:06 +00:00
virtfs-proxy-helper.rst docs: Move tools documentation to tools manual 2020-02-25 10:48:06 +00:00
virtiofsd.rst virtiofs: drop remapped security.capability xattr as needed 2021-03-04 10:26:16 +00:00