提交 0fa40517 编写于 作者: D Daniel P. Berrange

Don't allow remote driver daemon autostart when running setuid

We don't want setuid programs automatically spawning libvirtd,
so disable any use of autostart when setuid.
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>
(cherry picked from commit 171bb129)
上级 ef2ce590
...@@ -431,7 +431,7 @@ doRemoteOpen(virConnectPtr conn, ...@@ -431,7 +431,7 @@ doRemoteOpen(virConnectPtr conn,
trans_tcp, trans_tcp,
} transport; } transport;
#ifndef WIN32 #ifndef WIN32
const char *daemonPath; const char *daemonPath = NULL;
#endif #endif
/* We handle *ALL* URIs here. The caller has rejected any /* We handle *ALL* URIs here. The caller has rejected any
...@@ -713,7 +713,8 @@ doRemoteOpen(virConnectPtr conn, ...@@ -713,7 +713,8 @@ doRemoteOpen(virConnectPtr conn,
VIR_DEBUG("Proceeding with sockname %s", sockname); VIR_DEBUG("Proceeding with sockname %s", sockname);
} }
if (!(daemonPath = remoteFindDaemonPath())) { if ((flags & VIR_DRV_OPEN_REMOTE_AUTOSTART) &&
!(daemonPath = remoteFindDaemonPath())) {
virReportError(VIR_ERR_INTERNAL_ERROR, virReportError(VIR_ERR_INTERNAL_ERROR,
_("Unable to locate libvirtd daemon in %s " _("Unable to locate libvirtd daemon in %s "
"(to override, set $LIBVIRTD_PATH to the " "(to override, set $LIBVIRTD_PATH to the "
...@@ -997,8 +998,9 @@ remoteConnectOpen(virConnectPtr conn, ...@@ -997,8 +998,9 @@ remoteConnectOpen(virConnectPtr conn,
getuid() > 0) { getuid() > 0) {
VIR_DEBUG("Auto-spawn user daemon instance"); VIR_DEBUG("Auto-spawn user daemon instance");
rflags |= VIR_DRV_OPEN_REMOTE_USER; rflags |= VIR_DRV_OPEN_REMOTE_USER;
if (!autostart || if (!virIsSUID() &&
STRNEQ(autostart, "0")) (!autostart ||
STRNEQ(autostart, "0")))
rflags |= VIR_DRV_OPEN_REMOTE_AUTOSTART; rflags |= VIR_DRV_OPEN_REMOTE_AUTOSTART;
} }
...@@ -1014,8 +1016,9 @@ remoteConnectOpen(virConnectPtr conn, ...@@ -1014,8 +1016,9 @@ remoteConnectOpen(virConnectPtr conn,
if (getuid() > 0) { if (getuid() > 0) {
VIR_DEBUG("Auto-spawn user daemon instance"); VIR_DEBUG("Auto-spawn user daemon instance");
rflags |= VIR_DRV_OPEN_REMOTE_USER; rflags |= VIR_DRV_OPEN_REMOTE_USER;
if (!autostart || if (!virIsSUID() &&
STRNEQ(autostart, "0")) (!autostart ||
STRNEQ(autostart, "0")))
rflags |= VIR_DRV_OPEN_REMOTE_AUTOSTART; rflags |= VIR_DRV_OPEN_REMOTE_AUTOSTART;
} }
#endif #endif
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册