mirror of
https://gitlab.com/libvirt/libvirt.git
synced 2024-08-28 11:31:16 +00:00
api: disallow virConnectGetDomainCapabilities on read-only connections
This API can be used to execute arbitrary emulators. Forbid it on read-only connections. Fixes: CVE-2019-10167 Signed-off-by: Ján Tomko <jtomko@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
This commit is contained in:
parent
db0b78457f
commit
8afa68bac0
@ -11367,6 +11367,7 @@ virConnectGetDomainCapabilities(virConnectPtr conn,
|
|||||||
virResetLastError();
|
virResetLastError();
|
||||||
|
|
||||||
virCheckConnectReturn(conn, NULL);
|
virCheckConnectReturn(conn, NULL);
|
||||||
|
virCheckReadOnlyGoto(conn->flags, error);
|
||||||
|
|
||||||
if (conn->driver->connectGetDomainCapabilities) {
|
if (conn->driver->connectGetDomainCapabilities) {
|
||||||
char *ret;
|
char *ret;
|
||||||
|
Loading…
Reference in New Issue
Block a user