qemu-e2k/tools/virtiofsd
Max Reitz 63659fe74e virtiofsd: Whitelist fchmod
lo_setattr() invokes fchmod() in a rarely used code path, so it should
be whitelisted or virtiofsd will crash with EBADSYS.

Said code path can be triggered for example as follows:

On the host, in the shared directory, create a file with the sticky bit
set and a security.capability xattr:
(1) # touch foo
(2) # chmod u+s foo
(3) # setcap '' foo

Then in the guest let some process truncate that file after it has
dropped all of its capabilities (at least CAP_FSETID):

int main(int argc, char *argv[])
{
    capng_setpid(getpid());
    capng_clear(CAPNG_SELECT_BOTH);
    capng_updatev(CAPNG_ADD, CAPNG_PERMITTED | CAPNG_EFFECTIVE, 0);
    capng_apply(CAPNG_SELECT_BOTH);

    ftruncate(open(argv[1], O_RDWR), 0);
}

This will cause the guest kernel to drop the sticky bit (i.e. perform a
mode change) as part of the truncate (where FATTR_FH is set), and that
will cause virtiofsd to invoke fchmod() instead of fchmodat().

(A similar configuration exists further below with futimens() vs.
utimensat(), but the former is not a syscall but just a wrapper for the
latter, so no further whitelisting is required.)

Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=1842667
Reported-by: Qian Cai <caiqian@redhat.com>
Cc: qemu-stable@nongnu.org
Signed-off-by: Max Reitz <mreitz@redhat.com>
Message-Id: <20200608093111.14942-1-mreitz@redhat.com>
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Reviewed-by: Vivek Goyal <vgoyal@redhat.com>
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
2020-06-17 17:48:38 +01:00
..
50-qemu-virtiofsd.json.in virtiofsd: add vhost-user.json file 2020-01-23 16:41:36 +00:00
buffer.c virtiofsd: use fuse_buf_writev to replace fuse_buf_write for better performance 2020-01-23 16:41:37 +00:00
fuse_common.h virtiofsd: Parse flag FUSE_WRITE_KILL_PRIV 2020-01-23 16:41:37 +00:00
fuse_i.h virtiofsd: Remove fuse.h and struct fuse_module 2020-02-21 12:53:17 +00:00
fuse_log.c virtiofsd: Fix common header and define for QEMU builds 2020-01-23 16:41:36 +00:00
fuse_log.h virtiofsd: Format imported files to qemu style 2020-01-23 16:41:36 +00:00
fuse_lowlevel.c tools/virtiofsd/fuse_lowlevel: Fix fuse_out_header::error value 2020-02-21 12:53:17 +00:00
fuse_lowlevel.h virtiofsd: add --rlimit-nofile=NUM option 2020-05-01 18:41:55 +01:00
fuse_misc.h virtiofsd: support nanosecond resolution for file timestamp 2020-01-23 16:41:37 +00:00
fuse_opt.c virtiofsd: Fix common header and define for QEMU builds 2020-01-23 16:41:36 +00:00
fuse_opt.h virtiofsd: Format imported files to qemu style 2020-01-23 16:41:36 +00:00
fuse_signals.c virtiofsd: convert more fprintf and perror to use fuse log infra 2020-01-23 16:41:37 +00:00
fuse_virtio.c virtiofsd: Fix xattr operations 2020-03-03 15:13:24 +00:00
fuse_virtio.h virtiofsd: cleanup allocated resource in se 2020-01-23 16:41:37 +00:00
helper.c virtiofsd: stay below fs.file-max sysctl value (CVE-2020-10717) 2020-05-01 18:41:56 +01:00
Makefile.objs virtiofsd: add seccomp whitelist 2020-01-23 16:41:37 +00:00
passthrough_helpers.h virtiofsd: Format imported files to qemu style 2020-01-23 16:41:36 +00:00
passthrough_ll.c virtiofsd: remove symlink fallbacks 2020-06-01 18:44:27 +01:00
seccomp.c virtiofsd: Whitelist fchmod 2020-06-17 17:48:38 +01:00
seccomp.h virtiofsd: add --syslog command-line option 2020-01-23 16:41:37 +00:00