External/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2025-03-20 07:59:00 +00:00
Code

util: virfile: Only setuid for virFileRemove if on NFS

Browse Source 
NFS with root-squash is the only reason we need to do setuid/setgid
crazyness in virFileRemove, so limit that behavior to the NFS case.
This commit is contained in:
Cole Robinson 2016-03-09 12:20:37 -05:00
parent 7cf5343709
commit adefc561cc
1 changed files with 9 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
src/util/virfile.c
View File

@ -2315,6 +2315,7 @@ virFileOpenAs(const char *path, int openflags, mode_t mode,
/* virFileRemoveNeedsSetuid: /* virFileRemoveNeedsSetuid:
* @path: file we plan to remove
* @uid: file uid to check * @uid: file uid to check
* @gid: file gid to check * @gid: file gid to check
* *
@ -2322,7 +2323,7 @@ virFileOpenAs(const char *path, int openflags, mode_t mode,
* owned by the passed uid/gid pair. Needed for NFS with root-squash * owned by the passed uid/gid pair. Needed for NFS with root-squash
*/ */
static bool static bool
virFileRemoveNeedsSetuid(uid_t uid, gid_t gid) virFileRemoveNeedsSetuid(const char *path, uid_t uid, gid_t gid)
{ {
/* If running unprivileged, setuid isn't going to work */ /* If running unprivileged, setuid isn't going to work */
if (geteuid() != 0) if (geteuid() != 0)
@ -2336,6 +2337,12 @@ virFileRemoveNeedsSetuid(uid_t uid, gid_t gid)
if (uid == geteuid() && gid == getegid()) if (uid == geteuid() && gid == getegid())
return false; return false;
/* Only perform the setuid stuff for NFS, which is the only case
that may actually need it. This can error, but just be safe and
only check for a clear negative result. */
if (virFileIsSharedFSType(path, VIR_FILE_SHFS_NFS) == 0)
return false;
return true; return true;
} }
@ -2361,7 +2368,7 @@ virFileRemove(const char *path,
gid_t *groups; gid_t *groups;
int ngroups; int ngroups;
if (!virFileRemoveNeedsSetuid(uid, gid)) { if (!virFileRemoveNeedsSetuid(path, uid, gid)) {
if (virFileIsDir(path)) if (virFileIsDir(path))
return rmdir(path); return rmdir(path);
else else