9pfs: local: lsetxattr: don't follow symlinks
The local_lsetxattr() callback is vulnerable to symlink attacks because it calls lsetxattr() which follows symbolic links in all path elements but the rightmost one. This patch introduces a helper to emulate the non-existing fsetxattrat() function: it is implemented with /proc/self/fd which provides a trusted path that can be safely passed to lsetxattr(). local_lsetxattr() is converted to use this helper and opendir_nofollow(). This partly fixes CVE-2016-9602. Signed-off-by: Greg Kurz <groug@kaod.org> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
This commit is contained in:
parent
5507904e36
commit
3e36aba757
@ -50,13 +50,8 @@ static ssize_t mp_pacl_listxattr(FsContext *ctx, const char *path,
|
||||
static int mp_pacl_setxattr(FsContext *ctx, const char *path, const char *name,
|
||||
void *value, size_t size, int flags)
|
||||
{
|
||||
char *buffer;
|
||||
int ret;
|
||||
|
||||
buffer = rpath(ctx, path);
|
||||
ret = lsetxattr(buffer, MAP_ACL_ACCESS, value, size, flags);
|
||||
g_free(buffer);
|
||||
return ret;
|
||||
return local_setxattr_nofollow(ctx, path, MAP_ACL_ACCESS, value, size,
|
||||
flags);
|
||||
}
|
||||
|
||||
static int mp_pacl_removexattr(FsContext *ctx,
|
||||
@ -108,13 +103,8 @@ static ssize_t mp_dacl_listxattr(FsContext *ctx, const char *path,
|
||||
static int mp_dacl_setxattr(FsContext *ctx, const char *path, const char *name,
|
||||
void *value, size_t size, int flags)
|
||||
{
|
||||
char *buffer;
|
||||
int ret;
|
||||
|
||||
buffer = rpath(ctx, path);
|
||||
ret = lsetxattr(buffer, MAP_ACL_DEFAULT, value, size, flags);
|
||||
g_free(buffer);
|
||||
return ret;
|
||||
return local_setxattr_nofollow(ctx, path, MAP_ACL_DEFAULT, value, size,
|
||||
flags);
|
||||
}
|
||||
|
||||
static int mp_dacl_removexattr(FsContext *ctx,
|
||||
|
@ -48,5 +48,7 @@ int relative_openat_nofollow(int dirfd, const char *path, int flags,
|
||||
mode_t mode);
|
||||
ssize_t fgetxattrat_nofollow(int dirfd, const char *path, const char *name,
|
||||
void *value, size_t size);
|
||||
int fsetxattrat_nofollow(int dirfd, const char *path, const char *name,
|
||||
void *value, size_t size, int flags);
|
||||
|
||||
#endif
|
||||
|
@ -67,9 +67,6 @@ static ssize_t mp_user_listxattr(FsContext *ctx, const char *path,
|
||||
static int mp_user_setxattr(FsContext *ctx, const char *path, const char *name,
|
||||
void *value, size_t size, int flags)
|
||||
{
|
||||
char *buffer;
|
||||
int ret;
|
||||
|
||||
if (strncmp(name, "user.virtfs.", 12) == 0) {
|
||||
/*
|
||||
* Don't allow fetch of user.virtfs namesapce
|
||||
@ -78,10 +75,7 @@ static int mp_user_setxattr(FsContext *ctx, const char *path, const char *name,
|
||||
errno = EACCES;
|
||||
return -1;
|
||||
}
|
||||
buffer = rpath(ctx, path);
|
||||
ret = lsetxattr(buffer, name, value, size, flags);
|
||||
g_free(buffer);
|
||||
return ret;
|
||||
return local_setxattr_nofollow(ctx, path, name, value, size, flags);
|
||||
}
|
||||
|
||||
static int mp_user_removexattr(FsContext *ctx,
|
||||
|
@ -195,16 +195,43 @@ ssize_t pt_getxattr(FsContext *ctx, const char *path, const char *name,
|
||||
return local_getxattr_nofollow(ctx, path, name, value, size);
|
||||
}
|
||||
|
||||
int fsetxattrat_nofollow(int dirfd, const char *filename, const char *name,
|
||||
void *value, size_t size, int flags)
|
||||
{
|
||||
char *proc_path = g_strdup_printf("/proc/self/fd/%d/%s", dirfd, filename);
|
||||
int ret;
|
||||
|
||||
ret = lsetxattr(proc_path, name, value, size, flags);
|
||||
g_free(proc_path);
|
||||
return ret;
|
||||
}
|
||||
|
||||
ssize_t local_setxattr_nofollow(FsContext *ctx, const char *path,
|
||||
const char *name, void *value, size_t size,
|
||||
int flags)
|
||||
{
|
||||
char *dirpath = g_path_get_dirname(path);
|
||||
char *filename = g_path_get_basename(path);
|
||||
int dirfd;
|
||||
ssize_t ret = -1;
|
||||
|
||||
dirfd = local_opendir_nofollow(ctx, dirpath);
|
||||
if (dirfd == -1) {
|
||||
goto out;
|
||||
}
|
||||
|
||||
ret = fsetxattrat_nofollow(dirfd, filename, name, value, size, flags);
|
||||
close_preserve_errno(dirfd);
|
||||
out:
|
||||
g_free(dirpath);
|
||||
g_free(filename);
|
||||
return ret;
|
||||
}
|
||||
|
||||
int pt_setxattr(FsContext *ctx, const char *path, const char *name, void *value,
|
||||
size_t size, int flags)
|
||||
{
|
||||
char *buffer;
|
||||
int ret;
|
||||
|
||||
buffer = rpath(ctx, path);
|
||||
ret = lsetxattr(buffer, name, value, size, flags);
|
||||
g_free(buffer);
|
||||
return ret;
|
||||
return local_setxattr_nofollow(ctx, path, name, value, size, flags);
|
||||
}
|
||||
|
||||
int pt_removexattr(FsContext *ctx, const char *path, const char *name)
|
||||
|
@ -31,6 +31,9 @@ typedef struct xattr_operations
|
||||
|
||||
ssize_t local_getxattr_nofollow(FsContext *ctx, const char *path,
|
||||
const char *name, void *value, size_t size);
|
||||
ssize_t local_setxattr_nofollow(FsContext *ctx, const char *path,
|
||||
const char *name, void *value, size_t size,
|
||||
int flags);
|
||||
|
||||
extern XattrOperations mapped_user_xattr;
|
||||
extern XattrOperations passthrough_user_xattr;
|
||||
|
Loading…
Reference in New Issue
Block a user