External/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2025-01-11 23:37:42 +00:00
Code Issues Packages Projects Releases Wiki Activity

virt-aa-helper: Simplify restriction logic

Browse Source 
First check overrides, then read only files then restricted access
itself.

This allows us to mark files for read only access whose parents were
already restricted for read write.

Based on a proposal by Martin Kletzander

(cherry picked from commit d25a5e087ae10142d3d533ed193146736526b2ae)
This commit is contained in:
Guido Günther 2015-08-21 10:49:15 +02:00 committed by Cole Robinson
parent e50d84614a
commit a8eaab32e1
1 changed files with 18 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

29
src/security/virt-aa-helper.c
View File

@ -546,7 +546,9 @@ array_starts_with(const char *str, const char * const *arr, const long size)
static int
valid_path(const char *path, const bool readonly)
{
int npaths, opaths;
int npaths;
int nropaths;
const char * const restricted[] = {
"/bin/",
"/etc/",
@ -596,19 +598,24 @@ valid_path(const char *path, const bool readonly)
if (!virFileExists(path))
vah_warning(_("path does not exist, skipping file type checks"));
opaths = sizeof(override)/sizeof(*(override));
/* overrides are always allowed */
npaths = sizeof(override)/sizeof(*(override));
if (array_starts_with(path, override, npaths) == 0)
return 0;
npaths = sizeof(restricted)/sizeof(*(restricted));
if (array_starts_with(path, restricted, npaths) == 0 &&
array_starts_with(path, override, opaths) != 0)
return 1;
npaths = sizeof(restricted_rw)/sizeof(*(restricted_rw));
if (!readonly) {
if (array_starts_with(path, restricted_rw, npaths) == 0)
return 1;
/* allow read only paths upfront */
if (readonly) {
nropaths = sizeof(restricted_rw)/sizeof(*(restricted_rw));
if (array_starts_with(path, restricted_rw, nropaths) == 0)
return 0;
}
/* disallow RW acess to all paths in restricted and restriced_rw */
npaths = sizeof(restricted)/sizeof(*(restricted));
if ((array_starts_with(path, restricted, npaths) == 0
|| array_starts_with(path, restricted_rw, nropaths) == 0))
return 1;
return 0;
}