External/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2025-01-23 13:05:27 +00:00
Code Issues Packages Projects Releases Wiki Activity

CVE-2013-6456: Avoid unsafe use of /proc/$PID/root in LXC USB hotplug

Browse Source 
Rewrite lxcDomainAttachDeviceHostdevSubsysUSBLive function
to use the virProcessRunInMountNamespace helper. This avoids
risk of a malicious guest replacing /dev with a absolute
symlink, tricking the driver into changing the host OS
filesystem.

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
(cherry picked from commit 7fba01c15c1f886b4235825692b4c13e88dd9f7b)
This commit is contained in:
Daniel P. Berrange 2014-01-30 16:34:19 +00:00
parent d5c0b57fff
commit fcf05c194c
1 changed files with 22 additions and 51 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

73
src/lxc/lxc_driver.c
View File

@ -3078,6 +3078,13 @@ lxcDomainAttachDeviceMknodHelper(pid_t pid ATTRIBUTE_UNUSED,
def->src = tmpsrc; def->src = tmpsrc;
} break; } break;
case VIR_DOMAIN_DEVICE_HOSTDEV: {
virDomainHostdevDefPtr def = data->def->data.hostdev;
if (virSecurityManagerSetHostdevLabel(data->driver->securityManager,
data->vm->def, def, NULL) < 0)
goto cleanup;
} break;
default: default:
virReportError(VIR_ERR_INTERNAL_ERROR, virReportError(VIR_ERR_INTERNAL_ERROR,
_("Unexpected device type %d"), _("Unexpected device type %d"),
@ -3372,13 +3379,8 @@ lxcDomainAttachDeviceHostdevSubsysUSBLive(virLXCDriverPtr driver,
virLXCDomainObjPrivatePtr priv = vm->privateData; virLXCDomainObjPrivatePtr priv = vm->privateData;
virDomainHostdevDefPtr def = dev->data.hostdev; virDomainHostdevDefPtr def = dev->data.hostdev;
int ret = -1; int ret = -1;
char *vroot = NULL;
char *src = NULL; char *src = NULL;
char *dstdir = NULL;
char *dstfile = NULL;
struct stat sb; struct stat sb;
mode_t mode;
bool created = false;
virUSBDevicePtr usb = NULL; virUSBDevicePtr usb = NULL;
if (virDomainHostdevFind(vm->def, def, NULL) >= 0) { if (virDomainHostdevFind(vm->def, def, NULL) >= 0) {
@ -3387,27 +3389,13 @@ lxcDomainAttachDeviceHostdevSubsysUSBLive(virLXCDriverPtr driver,
return -1; return -1;
} }
if (virAsprintf(&vroot, "/proc/%llu/root",
(unsigned long long)priv->initpid) < 0)
goto cleanup;
if (virAsprintf(&dstdir, "%s/dev/bus/usb/%03d",
vroot,
def->source.subsys.u.usb.bus) < 0)
goto cleanup;
if (virAsprintf(&dstfile, "%s/%03d",
dstdir,
def->source.subsys.u.usb.device) < 0)
goto cleanup;
if (virAsprintf(&src, "/dev/bus/usb/%03d/%03d", if (virAsprintf(&src, "/dev/bus/usb/%03d/%03d",
def->source.subsys.u.usb.bus, def->source.subsys.u.usb.bus,
def->source.subsys.u.usb.device) < 0) def->source.subsys.u.usb.device) < 0)
goto cleanup; goto cleanup;
if (!(usb = virUSBDeviceNew(def->source.subsys.u.usb.bus, if (!(usb = virUSBDeviceNew(def->source.subsys.u.usb.bus,
def->source.subsys.u.usb.device, vroot))) def->source.subsys.u.usb.device, NULL)))
goto cleanup; goto cleanup;
if (stat(src, &sb) < 0) { if (stat(src, &sb) < 0) {
@ -3423,53 +3411,36 @@ lxcDomainAttachDeviceHostdevSubsysUSBLive(virLXCDriverPtr driver,
goto cleanup; goto cleanup;
} }
mode = 0700 | S_IFCHR;
if (VIR_REALLOC_N(vm->def->hostdevs, vm->def->nhostdevs + 1) < 0) if (VIR_REALLOC_N(vm->def->hostdevs, vm->def->nhostdevs + 1) < 0)
goto cleanup; goto cleanup;
if (virFileMakePath(dstdir) < 0) {
virReportSystemError(errno,
_("Unable to create %s"), dstdir);
goto cleanup;
}
VIR_DEBUG("Creating dev %s (%d,%d)",
dstfile, major(sb.st_rdev), minor(sb.st_rdev));
if (mknod(dstfile, mode, sb.st_rdev) < 0) {
virReportSystemError(errno,
_("Unable to create device %s"),
dstfile);
goto cleanup;
}
created = true;
if (lxcContainerChown(vm->def, dstfile) < 0)
goto cleanup;
if (virSecurityManagerSetHostdevLabel(driver->securityManager,
vm->def, def, vroot) < 0)
goto cleanup;
if (virUSBDeviceFileIterate(usb, if (virUSBDeviceFileIterate(usb,
virLXCSetupHostUsbDeviceCgroup, virLXCSetupHostUsbDeviceCgroup,
priv->cgroup) < 0) priv->cgroup) < 0)
goto cleanup; goto cleanup;
if (lxcDomainAttachDeviceMknod(driver,
0700 | S_IFCHR,
sb.st_rdev,
vm,
dev,
src) < 0) {
if (virUSBDeviceFileIterate(usb,
virLXCTeardownHostUsbDeviceCgroup,
priv->cgroup) < 0)
VIR_WARN("cannot deny device %s for domain %s",
src, vm->def->name);
goto cleanup;
}
vm->def->hostdevs[vm->def->nhostdevs++] = def; vm->def->hostdevs[vm->def->nhostdevs++] = def;
ret = 0; ret = 0;
cleanup: cleanup:
virDomainAuditHostdev(vm, def, "attach", ret == 0); virDomainAuditHostdev(vm, def, "attach", ret == 0);
if (ret < 0 && created)
unlink(dstfile);
virUSBDeviceFree(usb); virUSBDeviceFree(usb);
VIR_FREE(src); VIR_FREE(src);
VIR_FREE(dstfile);
VIR_FREE(dstdir);
VIR_FREE(vroot);
return ret; return ret;
} }