mirror of
https://gitlab.com/libvirt/libvirt.git
synced 2025-01-09 14:35:25 +00:00
Only allow the UNIX transport in remote driver when setuid
We don't know enough about quality of external libraries used
for non-UNIX transports, nor do we want to spawn external
commands when setuid. Restrict to the bare minimum which is
UNIX transport for local usage. Users shouldn't need to be
running setuid if connecting to remote hypervisors in any
case.
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
(cherry picked from commit e22b0232c7
)
This commit is contained in:
parent
eb892701c7
commit
ef2ce59055
@ -1135,6 +1135,12 @@ do_open(const char *name,
|
|||||||
if (name && name[0] == '\0')
|
if (name && name[0] == '\0')
|
||||||
name = NULL;
|
name = NULL;
|
||||||
|
|
||||||
|
if (!name && virIsSUID()) {
|
||||||
|
virReportError(VIR_ERR_INTERNAL_ERROR, "%s",
|
||||||
|
_("An explicit URI must be provided when setuid"));
|
||||||
|
goto failed;
|
||||||
|
}
|
||||||
|
|
||||||
/*
|
/*
|
||||||
* If no URI is passed, then check for an environment string if not
|
* If no URI is passed, then check for an environment string if not
|
||||||
* available probe the compiled in drivers to find a default hypervisor
|
* available probe the compiled in drivers to find a default hypervisor
|
||||||
|
@ -488,6 +488,20 @@ doRemoteOpen(virConnectPtr conn,
|
|||||||
transport = trans_unix;
|
transport = trans_unix;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
/*
|
||||||
|
* We don't want to be executing external programs in setuid mode,
|
||||||
|
* so this rules out 'ext' and 'ssh' transports. Exclude libssh
|
||||||
|
* and tls too, since we're not confident the libraries are safe
|
||||||
|
* for setuid usage. Just allow UNIX sockets, since that does
|
||||||
|
* not require any external libraries or command execution
|
||||||
|
*/
|
||||||
|
if (virIsSUID() &&
|
||||||
|
transport != trans_unix) {
|
||||||
|
virReportError(VIR_ERR_INTERNAL_ERROR, "%s",
|
||||||
|
_("Only Unix socket URI transport is allowed in setuid mode"));
|
||||||
|
return VIR_DRV_OPEN_ERROR;
|
||||||
|
}
|
||||||
|
|
||||||
/* Local variables which we will initialize. These can
|
/* Local variables which we will initialize. These can
|
||||||
* get freed in the failed: path.
|
* get freed in the failed: path.
|
||||||
*/
|
*/
|
||||||
|
Loading…
Reference in New Issue
Block a user