External/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2025-01-08 22:15:21 +00:00
Code Issues Packages Projects Releases Wiki Activity

CVE-2013-6456: Avoid unsafe use of /proc/$PID/root in LXC chardev hostdev hotplug

Browse Source 
Rewrite lxcDomainAttachDeviceHostdevMiscLive function
to use the virProcessRunInMountNamespace helper. This avoids
risk of a malicious guest replacing /dev with a absolute
symlink, tricking the driver into changing the host OS
filesystem.

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
(cherry picked from commit 1cadeafcaa)
This commit is contained in:
Daniel P. Berrange 2014-01-30 17:47:39 +00:00
parent 72e379ed93
commit cb016b9ef1
1 changed files with 18 additions and 48 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

66
src/lxc/lxc_driver.c
View File

@ -3525,11 +3525,7 @@ lxcDomainAttachDeviceHostdevMiscLive(virLXCDriverPtr driver,
virLXCDomainObjPrivatePtr priv = vm->privateData; virLXCDomainObjPrivatePtr priv = vm->privateData;
virDomainHostdevDefPtr def = dev->data.hostdev; virDomainHostdevDefPtr def = dev->data.hostdev;
int ret = -1; int ret = -1;
char *dst = NULL;
char *vroot = NULL;
struct stat sb; struct stat sb;
bool created = false;
mode_t mode = 0;
if (!def->source.caps.u.misc.chardev) { if (!def->source.caps.u.misc.chardev) {
virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
@ -3557,51 +3553,29 @@ lxcDomainAttachDeviceHostdevMiscLive(virLXCDriverPtr driver,
goto cleanup; goto cleanup;
} }
if (virAsprintf(&vroot, "/proc/%llu/root", if (virCgroupAllowDevice(priv->cgroup,
(unsigned long long)priv->initpid) < 0) 'c',
goto cleanup; major(sb.st_rdev),
minor(sb.st_rdev),
if (virAsprintf(&dst, "%s/%s", VIR_CGROUP_DEVICE_RWM) < 0)
vroot,
def->source.caps.u.misc.chardev) < 0)
goto cleanup; goto cleanup;
if (VIR_REALLOC_N(vm->def->hostdevs, vm->def->nhostdevs+1) < 0) if (VIR_REALLOC_N(vm->def->hostdevs, vm->def->nhostdevs+1) < 0)
goto cleanup; goto cleanup;
if (lxcContainerSetupHostdevCapsMakePath(dst) < 0) { if (lxcDomainAttachDeviceMknod(driver,
virReportSystemError(errno, 0700 | S_IFBLK,
_("Unable to create directory for device %s"), sb.st_rdev,
dst); vm,
goto cleanup; dev,
} def->source.caps.u.misc.chardev) < 0) {
if (virCgroupDenyDevice(priv->cgroup,
mode = 0700 | S_IFCHR; 'c',
major(sb.st_rdev),
VIR_DEBUG("Creating dev %s (%d,%d)", minor(sb.st_rdev),
def->source.caps.u.misc.chardev, VIR_CGROUP_DEVICE_RWM) < 0)
major(sb.st_rdev), minor(sb.st_rdev)); VIR_WARN("cannot deny device %s for domain %s",
if (mknod(dst, mode, sb.st_rdev) < 0) { def->source.caps.u.storage.block, vm->def->name);
virReportSystemError(errno,
_("Unable to create device %s"),
dst);
goto cleanup;
}
created = true;
if (lxcContainerChown(vm->def, dst) < 0)
goto cleanup;
if (virSecurityManagerSetHostdevLabel(driver->securityManager,
vm->def, def, vroot) < 0)
goto cleanup;
if (virCgroupAllowDevicePath(priv->cgroup, def->source.caps.u.misc.chardev,
VIR_CGROUP_DEVICE_RW |
VIR_CGROUP_DEVICE_MKNOD) != 0) {
virReportError(VIR_ERR_INTERNAL_ERROR,
_("cannot allow device %s for domain %s"),
def->source.caps.u.misc.chardev, vm->def->name);
goto cleanup; goto cleanup;
} }
@ -3611,10 +3585,6 @@ lxcDomainAttachDeviceHostdevMiscLive(virLXCDriverPtr driver,
cleanup: cleanup:
virDomainAuditHostdev(vm, def, "attach", ret == 0); virDomainAuditHostdev(vm, def, "attach", ret == 0);
if (dst && created && ret < 0)
unlink(dst);
VIR_FREE(dst);
VIR_FREE(vroot);
return ret; return ret;
} }