From 89b2e56d7a37b0ab68f5185c2f11db80072f258f Mon Sep 17 00:00:00 2001 From: "Daniel P. Berrange" Date: Wed, 9 Oct 2013 11:44:50 +0100 Subject: [PATCH] Only allow the UNIX transport in remote driver when setuid We don't know enough about quality of external libraries used for non-UNIX transports, nor do we want to spawn external commands when setuid. Restrict to the bare minimum which is UNIX transport for local usage. Users shouldn't need to be running setuid if connecting to remote hypervisors in any case. Signed-off-by: Daniel P. Berrange (cherry picked from commit e22b0232c7b94aefaef87c52c4d626fa532fcce3) --- src/libvirt.c | 6 ++++++ src/remote/remote_driver.c | 14 ++++++++++++++ 2 files changed, 20 insertions(+) diff --git a/src/libvirt.c b/src/libvirt.c index 5c65e2a8fa..baa62c44d4 100644 --- a/src/libvirt.c +++ b/src/libvirt.c @@ -1135,6 +1135,12 @@ do_open(const char *name, if (name && name[0] == '\0') name = NULL; + if (!name && virIsSUID()) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", + _("An explicit URI must be provided when setuid")); + goto failed; + } + /* * If no URI is passed, then check for an environment string if not * available probe the compiled in drivers to find a default hypervisor diff --git a/src/remote/remote_driver.c b/src/remote/remote_driver.c index 67daf792b2..b6b629cdf8 100644 --- a/src/remote/remote_driver.c +++ b/src/remote/remote_driver.c @@ -488,6 +488,20 @@ doRemoteOpen(virConnectPtr conn, transport = trans_unix; } + /* + * We don't want to be executing external programs in setuid mode, + * so this rules out 'ext' and 'ssh' transports. Exclude libssh + * and tls too, since we're not confident the libraries are safe + * for setuid usage. Just allow UNIX sockets, since that does + * not require any external libraries or command execution + */ + if (virIsSUID() && + transport != trans_unix) { + virReportError(VIR_ERR_INTERNAL_ERROR, "%s", + _("Only Unix socket URI transport is allowed in setuid mode")); + return VIR_DRV_OPEN_ERROR; + } + /* Local variables which we will initialize. These can * get freed in the failed: path. */