提交 5fc590ad 编写于 作者: D Daniel P. Berrange

CVE-2013-6456: Avoid unsafe use of /proc/$PID/root in LXC hotunplug code

Rewrite multiple hotunplug functions to to use the
virProcessRunInMountNamespace helper. This avoids
risk of a malicious guest replacing /dev with an absolute
symlink, tricking the driver into changing the host OS
filesystem.
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>
上级 1cadeafc
...@@ -3773,6 +3773,39 @@ lxcDomainAttachDeviceMknod(virLXCDriverPtr driver, ...@@ -3773,6 +3773,39 @@ lxcDomainAttachDeviceMknod(virLXCDriverPtr driver,
} }
static int
lxcDomainAttachDeviceUnlinkHelper(pid_t pid ATTRIBUTE_UNUSED,
void *opaque)
{
const char *path = opaque;
VIR_DEBUG("Unlinking %s", path);
if (unlink(path) < 0 && errno != ENOENT) {
virReportSystemError(errno,
_("Unable to remove device %s"), path);
return -1;
}
return 0;
}
static int
lxcDomainAttachDeviceUnlink(virDomainObjPtr vm,
char *file)
{
virLXCDomainObjPrivatePtr priv = vm->privateData;
if (virProcessRunInMountNamespace(priv->initpid,
lxcDomainAttachDeviceUnlinkHelper,
file) < 0) {
return -1;
}
return 0;
}
static int static int
lxcDomainAttachDeviceDiskLive(virLXCDriverPtr driver, lxcDomainAttachDeviceDiskLive(virLXCDriverPtr driver,
virDomainObjPtr vm, virDomainObjPtr vm,
...@@ -4364,8 +4397,7 @@ lxcDomainDetachDeviceDiskLive(virDomainObjPtr vm, ...@@ -4364,8 +4397,7 @@ lxcDomainDetachDeviceDiskLive(virDomainObjPtr vm,
def = vm->def->disks[idx]; def = vm->def->disks[idx];
if (virAsprintf(&dst, "/proc/%llu/root/dev/%s", if (virAsprintf(&dst, "/dev/%s", def->dst) < 0)
(unsigned long long)priv->initpid, def->dst) < 0)
goto cleanup; goto cleanup;
if (!virCgroupHasController(priv->cgroup, VIR_CGROUP_CONTROLLER_DEVICES)) { if (!virCgroupHasController(priv->cgroup, VIR_CGROUP_CONTROLLER_DEVICES)) {
...@@ -4374,11 +4406,8 @@ lxcDomainDetachDeviceDiskLive(virDomainObjPtr vm, ...@@ -4374,11 +4406,8 @@ lxcDomainDetachDeviceDiskLive(virDomainObjPtr vm,
goto cleanup; goto cleanup;
} }
VIR_DEBUG("Unlinking %s (backed by %s)", dst, def->src); if (lxcDomainAttachDeviceUnlink(vm, dst) < 0) {
if (unlink(dst) < 0 && errno != ENOENT) {
virDomainAuditDisk(vm, def->src, NULL, "detach", false); virDomainAuditDisk(vm, def->src, NULL, "detach", false);
virReportSystemError(errno,
_("Unable to remove device %s"), dst);
goto cleanup; goto cleanup;
} }
virDomainAuditDisk(vm, def->src, NULL, "detach", true); virDomainAuditDisk(vm, def->src, NULL, "detach", true);
...@@ -4473,7 +4502,6 @@ lxcDomainDetachDeviceHostdevUSBLive(virLXCDriverPtr driver, ...@@ -4473,7 +4502,6 @@ lxcDomainDetachDeviceHostdevUSBLive(virLXCDriverPtr driver,
virDomainHostdevDefPtr def = NULL; virDomainHostdevDefPtr def = NULL;
int idx, ret = -1; int idx, ret = -1;
char *dst = NULL; char *dst = NULL;
char *vroot = NULL;
virUSBDevicePtr usb = NULL; virUSBDevicePtr usb = NULL;
if ((idx = virDomainHostdevFind(vm->def, if ((idx = virDomainHostdevFind(vm->def,
...@@ -4484,12 +4512,7 @@ lxcDomainDetachDeviceHostdevUSBLive(virLXCDriverPtr driver, ...@@ -4484,12 +4512,7 @@ lxcDomainDetachDeviceHostdevUSBLive(virLXCDriverPtr driver,
goto cleanup; goto cleanup;
} }
if (virAsprintf(&vroot, "/proc/%llu/root", if (virAsprintf(&dst, "/dev/bus/usb/%03d/%03d",
(unsigned long long)priv->initpid) < 0)
goto cleanup;
if (virAsprintf(&dst, "%s/dev/bus/usb/%03d/%03d",
vroot,
def->source.subsys.u.usb.bus, def->source.subsys.u.usb.bus,
def->source.subsys.u.usb.device) < 0) def->source.subsys.u.usb.device) < 0)
goto cleanup; goto cleanup;
...@@ -4504,11 +4527,8 @@ lxcDomainDetachDeviceHostdevUSBLive(virLXCDriverPtr driver, ...@@ -4504,11 +4527,8 @@ lxcDomainDetachDeviceHostdevUSBLive(virLXCDriverPtr driver,
def->source.subsys.u.usb.device, NULL))) def->source.subsys.u.usb.device, NULL)))
goto cleanup; goto cleanup;
VIR_DEBUG("Unlinking %s", dst); if (lxcDomainAttachDeviceUnlink(vm, dst) < 0) {
if (unlink(dst) < 0 && errno != ENOENT) {
virDomainAuditHostdev(vm, def, "detach", false); virDomainAuditHostdev(vm, def, "detach", false);
virReportSystemError(errno,
_("Unable to remove device %s"), dst);
goto cleanup; goto cleanup;
} }
virDomainAuditHostdev(vm, def, "detach", true); virDomainAuditHostdev(vm, def, "detach", true);
...@@ -4531,7 +4551,6 @@ lxcDomainDetachDeviceHostdevUSBLive(virLXCDriverPtr driver, ...@@ -4531,7 +4551,6 @@ lxcDomainDetachDeviceHostdevUSBLive(virLXCDriverPtr driver,
cleanup: cleanup:
virUSBDeviceFree(usb); virUSBDeviceFree(usb);
VIR_FREE(dst); VIR_FREE(dst);
VIR_FREE(vroot);
return ret; return ret;
} }
...@@ -4543,7 +4562,6 @@ lxcDomainDetachDeviceHostdevStorageLive(virDomainObjPtr vm, ...@@ -4543,7 +4562,6 @@ lxcDomainDetachDeviceHostdevStorageLive(virDomainObjPtr vm,
virLXCDomainObjPrivatePtr priv = vm->privateData; virLXCDomainObjPrivatePtr priv = vm->privateData;
virDomainHostdevDefPtr def = NULL; virDomainHostdevDefPtr def = NULL;
int idx, ret = -1; int idx, ret = -1;
char *dst = NULL;
if (!priv->initpid) { if (!priv->initpid) {
virReportError(VIR_ERR_OPERATION_INVALID, "%s", virReportError(VIR_ERR_OPERATION_INVALID, "%s",
...@@ -4560,22 +4578,14 @@ lxcDomainDetachDeviceHostdevStorageLive(virDomainObjPtr vm, ...@@ -4560,22 +4578,14 @@ lxcDomainDetachDeviceHostdevStorageLive(virDomainObjPtr vm,
goto cleanup; goto cleanup;
} }
if (virAsprintf(&dst, "/proc/%llu/root/%s",
(unsigned long long)priv->initpid,
def->source.caps.u.storage.block) < 0)
goto cleanup;
if (!virCgroupHasController(priv->cgroup, VIR_CGROUP_CONTROLLER_DEVICES)) { if (!virCgroupHasController(priv->cgroup, VIR_CGROUP_CONTROLLER_DEVICES)) {
virReportError(VIR_ERR_OPERATION_INVALID, "%s", virReportError(VIR_ERR_OPERATION_INVALID, "%s",
_("devices cgroup isn't mounted")); _("devices cgroup isn't mounted"));
goto cleanup; goto cleanup;
} }
VIR_DEBUG("Unlinking %s", dst); if (lxcDomainAttachDeviceUnlink(vm, def->source.caps.u.storage.block) < 0) {
if (unlink(dst) < 0 && errno != ENOENT) {
virDomainAuditHostdev(vm, def, "detach", false); virDomainAuditHostdev(vm, def, "detach", false);
virReportSystemError(errno,
_("Unable to remove device %s"), dst);
goto cleanup; goto cleanup;
} }
virDomainAuditHostdev(vm, def, "detach", true); virDomainAuditHostdev(vm, def, "detach", true);
...@@ -4590,7 +4600,6 @@ lxcDomainDetachDeviceHostdevStorageLive(virDomainObjPtr vm, ...@@ -4590,7 +4600,6 @@ lxcDomainDetachDeviceHostdevStorageLive(virDomainObjPtr vm,
ret = 0; ret = 0;
cleanup: cleanup:
VIR_FREE(dst);
return ret; return ret;
} }
...@@ -4602,7 +4611,6 @@ lxcDomainDetachDeviceHostdevMiscLive(virDomainObjPtr vm, ...@@ -4602,7 +4611,6 @@ lxcDomainDetachDeviceHostdevMiscLive(virDomainObjPtr vm,
virLXCDomainObjPrivatePtr priv = vm->privateData; virLXCDomainObjPrivatePtr priv = vm->privateData;
virDomainHostdevDefPtr def = NULL; virDomainHostdevDefPtr def = NULL;
int idx, ret = -1; int idx, ret = -1;
char *dst = NULL;
if (!priv->initpid) { if (!priv->initpid) {
virReportError(VIR_ERR_OPERATION_INVALID, "%s", virReportError(VIR_ERR_OPERATION_INVALID, "%s",
...@@ -4619,22 +4627,14 @@ lxcDomainDetachDeviceHostdevMiscLive(virDomainObjPtr vm, ...@@ -4619,22 +4627,14 @@ lxcDomainDetachDeviceHostdevMiscLive(virDomainObjPtr vm,
goto cleanup; goto cleanup;
} }
if (virAsprintf(&dst, "/proc/%llu/root/%s",
(unsigned long long)priv->initpid,
def->source.caps.u.misc.chardev) < 0)
goto cleanup;
if (!virCgroupHasController(priv->cgroup, VIR_CGROUP_CONTROLLER_DEVICES)) { if (!virCgroupHasController(priv->cgroup, VIR_CGROUP_CONTROLLER_DEVICES)) {
virReportError(VIR_ERR_OPERATION_INVALID, "%s", virReportError(VIR_ERR_OPERATION_INVALID, "%s",
_("devices cgroup isn't mounted")); _("devices cgroup isn't mounted"));
goto cleanup; goto cleanup;
} }
VIR_DEBUG("Unlinking %s", dst); if (lxcDomainAttachDeviceUnlink(vm, def->source.caps.u.misc.chardev) < 0) {
if (unlink(dst) < 0 && errno != ENOENT) {
virDomainAuditHostdev(vm, def, "detach", false); virDomainAuditHostdev(vm, def, "detach", false);
virReportSystemError(errno,
_("Unable to remove device %s"), dst);
goto cleanup; goto cleanup;
} }
virDomainAuditHostdev(vm, def, "detach", true); virDomainAuditHostdev(vm, def, "detach", true);
...@@ -4649,7 +4649,6 @@ lxcDomainDetachDeviceHostdevMiscLive(virDomainObjPtr vm, ...@@ -4649,7 +4649,6 @@ lxcDomainDetachDeviceHostdevMiscLive(virDomainObjPtr vm,
ret = 0; ret = 0;
cleanup: cleanup:
VIR_FREE(dst);
return ret; return ret;
} }
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册