virtiofsd: Allow addition or removal of capabilities
Allow capabilities to be added or removed from the allowed set for the daemon; e.g. default: CapPrm: 00000000880000df CapEff: 00000000880000df -o modcaps=+sys_admin CapPrm: 00000000882000df CapEff: 00000000882000df -o modcaps=+sys_admin:-chown CapPrm: 00000000882000de CapEff: 00000000882000de Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Message-Id: <20200629115420.98443-4-dgilbert@redhat.com> Acked-by: Vivek Goyal <vgoyal@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
This commit is contained in:
parent
55b22a60cc
commit
3005c099ef
|
@ -54,6 +54,11 @@ Options
|
||||||
* flock|no_flock -
|
* flock|no_flock -
|
||||||
Enable/disable flock. The default is ``no_flock``.
|
Enable/disable flock. The default is ``no_flock``.
|
||||||
|
|
||||||
|
* modcaps=CAPLIST
|
||||||
|
Modify the list of capabilities allowed; CAPLIST is a colon separated
|
||||||
|
list of capabilities, each preceded by either + or -, e.g.
|
||||||
|
''+sys_admin:-chown''.
|
||||||
|
|
||||||
* log_level=LEVEL -
|
* log_level=LEVEL -
|
||||||
Print only log messages matching LEVEL or more severe. LEVEL is one of
|
Print only log messages matching LEVEL or more severe. LEVEL is one of
|
||||||
``err``, ``warn``, ``info``, or ``debug``. The default is ``info``.
|
``err``, ``warn``, ``info``, or ``debug``. The default is ``info``.
|
||||||
|
|
|
@ -174,6 +174,8 @@ void fuse_cmdline_help(void)
|
||||||
" default: no_writeback\n"
|
" default: no_writeback\n"
|
||||||
" -o xattr|no_xattr enable/disable xattr\n"
|
" -o xattr|no_xattr enable/disable xattr\n"
|
||||||
" default: no_xattr\n"
|
" default: no_xattr\n"
|
||||||
|
" -o modcaps=CAPLIST Modify the list of capabilities\n"
|
||||||
|
" e.g. -o modcaps=+sys_admin:-chown\n"
|
||||||
" --rlimit-nofile=<num> set maximum number of file descriptors\n"
|
" --rlimit-nofile=<num> set maximum number of file descriptors\n"
|
||||||
" (0 leaves rlimit unchanged)\n"
|
" (0 leaves rlimit unchanged)\n"
|
||||||
" default: min(1000000, fs.file-max - 16384)\n"
|
" default: min(1000000, fs.file-max - 16384)\n"
|
||||||
|
|
|
@ -145,6 +145,7 @@ struct lo_data {
|
||||||
int posix_lock;
|
int posix_lock;
|
||||||
int xattr;
|
int xattr;
|
||||||
char *source;
|
char *source;
|
||||||
|
char *modcaps;
|
||||||
double timeout;
|
double timeout;
|
||||||
int cache;
|
int cache;
|
||||||
int timeout_set;
|
int timeout_set;
|
||||||
|
@ -170,6 +171,7 @@ static const struct fuse_opt lo_opts[] = {
|
||||||
{ "no_posix_lock", offsetof(struct lo_data, posix_lock), 0 },
|
{ "no_posix_lock", offsetof(struct lo_data, posix_lock), 0 },
|
||||||
{ "xattr", offsetof(struct lo_data, xattr), 1 },
|
{ "xattr", offsetof(struct lo_data, xattr), 1 },
|
||||||
{ "no_xattr", offsetof(struct lo_data, xattr), 0 },
|
{ "no_xattr", offsetof(struct lo_data, xattr), 0 },
|
||||||
|
{ "modcaps=%s", offsetof(struct lo_data, modcaps), 0 },
|
||||||
{ "timeout=%lf", offsetof(struct lo_data, timeout), 0 },
|
{ "timeout=%lf", offsetof(struct lo_data, timeout), 0 },
|
||||||
{ "timeout=", offsetof(struct lo_data, timeout_set), 1 },
|
{ "timeout=", offsetof(struct lo_data, timeout_set), 1 },
|
||||||
{ "cache=none", offsetof(struct lo_data, cache), CACHE_NONE },
|
{ "cache=none", offsetof(struct lo_data, cache), CACHE_NONE },
|
||||||
|
@ -2570,9 +2572,11 @@ static void setup_mounts(const char *source)
|
||||||
|
|
||||||
/*
|
/*
|
||||||
* Only keep whitelisted capabilities that are needed for file system operation
|
* Only keep whitelisted capabilities that are needed for file system operation
|
||||||
|
* The (possibly NULL) modcaps_in string passed in is free'd before exit.
|
||||||
*/
|
*/
|
||||||
static void setup_capabilities(void)
|
static void setup_capabilities(char *modcaps_in)
|
||||||
{
|
{
|
||||||
|
char *modcaps = modcaps_in;
|
||||||
pthread_mutex_lock(&cap.mutex);
|
pthread_mutex_lock(&cap.mutex);
|
||||||
capng_restore_state(&cap.saved);
|
capng_restore_state(&cap.saved);
|
||||||
|
|
||||||
|
@ -2604,6 +2608,51 @@ static void setup_capabilities(void)
|
||||||
exit(1);
|
exit(1);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
/*
|
||||||
|
* The modcaps option is a colon separated list of caps,
|
||||||
|
* each preceded by either + or -.
|
||||||
|
*/
|
||||||
|
while (modcaps) {
|
||||||
|
capng_act_t action;
|
||||||
|
int cap;
|
||||||
|
|
||||||
|
char *next = strchr(modcaps, ':');
|
||||||
|
if (next) {
|
||||||
|
*next = '\0';
|
||||||
|
next++;
|
||||||
|
}
|
||||||
|
|
||||||
|
switch (modcaps[0]) {
|
||||||
|
case '+':
|
||||||
|
action = CAPNG_ADD;
|
||||||
|
break;
|
||||||
|
|
||||||
|
case '-':
|
||||||
|
action = CAPNG_DROP;
|
||||||
|
break;
|
||||||
|
|
||||||
|
default:
|
||||||
|
fuse_log(FUSE_LOG_ERR,
|
||||||
|
"%s: Expecting '+'/'-' in modcaps but found '%c'\n",
|
||||||
|
__func__, modcaps[0]);
|
||||||
|
exit(1);
|
||||||
|
}
|
||||||
|
cap = capng_name_to_capability(modcaps + 1);
|
||||||
|
if (cap < 0) {
|
||||||
|
fuse_log(FUSE_LOG_ERR, "%s: Unknown capability '%s'\n", __func__,
|
||||||
|
modcaps);
|
||||||
|
exit(1);
|
||||||
|
}
|
||||||
|
if (capng_update(action, CAPNG_PERMITTED | CAPNG_EFFECTIVE, cap)) {
|
||||||
|
fuse_log(FUSE_LOG_ERR, "%s: capng_update failed for '%s'\n",
|
||||||
|
__func__, modcaps);
|
||||||
|
exit(1);
|
||||||
|
}
|
||||||
|
|
||||||
|
modcaps = next;
|
||||||
|
}
|
||||||
|
g_free(modcaps_in);
|
||||||
|
|
||||||
if (capng_apply(CAPNG_SELECT_BOTH)) {
|
if (capng_apply(CAPNG_SELECT_BOTH)) {
|
||||||
fuse_log(FUSE_LOG_ERR, "%s: capng_apply failed\n", __func__);
|
fuse_log(FUSE_LOG_ERR, "%s: capng_apply failed\n", __func__);
|
||||||
exit(1);
|
exit(1);
|
||||||
|
@ -2627,7 +2676,7 @@ static void setup_sandbox(struct lo_data *lo, struct fuse_session *se,
|
||||||
setup_namespaces(lo, se);
|
setup_namespaces(lo, se);
|
||||||
setup_mounts(lo->source);
|
setup_mounts(lo->source);
|
||||||
setup_seccomp(enable_syslog);
|
setup_seccomp(enable_syslog);
|
||||||
setup_capabilities();
|
setup_capabilities(g_strdup(lo->modcaps));
|
||||||
}
|
}
|
||||||
|
|
||||||
/* Set the maximum number of open file descriptors */
|
/* Set the maximum number of open file descriptors */
|
||||||
|
|
Loading…
Reference in New Issue