External/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2025-01-23 21:15:20 +00:00
Code Issues Packages Projects Releases Wiki Activity

nwfilter: Partly initialize driver even for non-privileged users

Browse Source 
https://bugzilla.redhat.com/show_bug.cgi?id=1211436

This reverts commit b7829f959b33c6e32422222a9ed745c0da7dc696.

The previous fix was not correct. Like everywhere else, a driver is a
global variable allocated in stateInitialize function (or something
similar for stateless drivers). Later, when a driver API is called,
it's possible that the global variable is accessed and dereferenced.
Now, some drivers require root privileges because they undertake some
actions reserved only for the system admin (e.g. manipulating host
firewall). And here's the trouble, the NWFilter state initializer
exited too early when finding out it's running unprivileged, leaving
the global NWFilter driver variable uninitialized. Any subsequent
API call that tried to lock the driver resulted in dereferencing the
driver and thus crash.

On the other hand, in order to not resurrect the bug the original
commit was fixing, Let's forbid the nwfilter define in session mode.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>

Conflicts:
	src/nwfilter/nwfilter_driver.c: Context. Code changed a bit
        since 2013.

(cherry picked from commit 77d92e2e77f0dae8fc9e1eb5fa0db9fc9f2818bd)
This commit is contained in:
Michal Privoznik 2015-04-16 09:59:22 +02:00 committed by Cole Robinson
parent 5328780b5f
commit 10736cb41c
1 changed files with 9 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
src/nwfilter/nwfilter_driver.c
View File

@ -176,9 +176,6 @@ nwfilterStateInitialize(bool privileged,
char *base = NULL;
DBusConnection *sysbus = NULL;
if (!privileged)
return 0;
if (virDBusHasSystemBus() &&
!(sysbus = virDBusGetSystemBus()))
return -1;
@ -193,6 +190,9 @@ nwfilterStateInitialize(bool privileged,
driver->watchingFirewallD = (sysbus != NULL);
driver->privileged = privileged;
if (!privileged)
return 0;
nwfilterDriverLock();
if (virNWFilterIPAddrMapInit() < 0)
@ -535,6 +535,12 @@ nwfilterDefineXML(virConnectPtr conn,
virNWFilterObjPtr nwfilter = NULL;
virNWFilterPtr ret = NULL;
if (!driver->privileged) {
virReportError(VIR_ERR_OPERATION_INVALID, "%s",
_("Can't define NWFilters in session mode"));
return NULL;
}
nwfilterDriverLock();
virNWFilterWriteLockFilterUpdates();
virNWFilterCallbackDriversLock();