mirror of
https://gitlab.com/libvirt/libvirt.git
synced 2024-12-22 05:35:25 +00:00
api: disallow virConnectGetDomainCapabilities on read-only connections
This API can be used to execute arbitrary emulators.
Forbid it on read-only connections.
Fixes: CVE-2019-10167
Signed-off-by: Ján Tomko <jtomko@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
(cherry picked from commit 8afa68bac0
)
Signed-off-by: Ján Tomko <jtomko@redhat.com>
This commit is contained in:
parent
b22baef312
commit
a663e28410
@ -11303,6 +11303,7 @@ virConnectGetDomainCapabilities(virConnectPtr conn,
|
|||||||
virResetLastError();
|
virResetLastError();
|
||||||
|
|
||||||
virCheckConnectReturn(conn, NULL);
|
virCheckConnectReturn(conn, NULL);
|
||||||
|
virCheckReadOnlyGoto(conn->flags, error);
|
||||||
|
|
||||||
if (conn->driver->connectGetDomainCapabilities) {
|
if (conn->driver->connectGetDomainCapabilities) {
|
||||||
char *ret;
|
char *ret;
|
||||||
|
Loading…
Reference in New Issue
Block a user