[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-stable] [PATCH 04/81] 9pfs: introduce relative_openat_nofollow() h
From: |
Michael Roth |
Subject: |
[Qemu-stable] [PATCH 04/81] 9pfs: introduce relative_openat_nofollow() helper |
Date: |
Mon, 20 Mar 2017 18:07:28 -0500 |
From: Greg Kurz <address@hidden>
When using the passthrough security mode, symbolic links created by the
guest are actual symbolic links on the host file system.
Since the resolution of symbolic links during path walk is supposed to
occur on the client side. The server should hence never receive any path
pointing to an actual symbolic link. This isn't guaranteed by the protocol
though, and malicious code in the guest can trick the server to issue
various syscalls on paths whose one or more elements are symbolic links.
In the case of the "local" backend using the "passthrough" or "none"
security modes, the guest can directly create symbolic links to arbitrary
locations on the host (as per spec). The "mapped-xattr" and "mapped-file"
security modes are also affected to a lesser extent as they require some
help from an external entity to create actual symbolic links on the host,
i.e. another guest using "passthrough" mode for example.
The current code hence relies on O_NOFOLLOW and "l*()" variants of system
calls. Unfortunately, this only applies to the rightmost path component.
A guest could maliciously replace any component in a trusted path with a
symbolic link. This could allow any guest to escape a virtfs shared folder.
This patch introduces a variant of the openat() syscall that successively
opens each path element with O_NOFOLLOW. When passing a file descriptor
pointing to a trusted directory, one is guaranteed to be returned a
file descriptor pointing to a path which is beneath the trusted directory.
This will be used by subsequent patches to implement symlink-safe path walk
for any access to the backend.
Symbolic links aren't the only threats actually: a malicious guest could
change a path element to point to other types of file with undesirable
effects:
- a named pipe or any other thing that would cause openat() to block
- a terminal device which would become QEMU's controlling terminal
These issues can be addressed with O_NONBLOCK and O_NOCTTY.
Two helpers are introduced: one to open intermediate path elements and one
to open the rightmost path element.
Suggested-by: Jann Horn <address@hidden>
Signed-off-by: Greg Kurz <address@hidden>
Reviewed-by: Stefan Hajnoczi <address@hidden>
(renamed openat_nofollow() to relative_openat_nofollow(),
assert path is relative and doesn't contain '//',
fixed side-effect in assert, Greg Kurz)
Signed-off-by: Greg Kurz <address@hidden>
(cherry picked from commit 6482a961636d66cc10928dde5d4d908206e5f65a)
Signed-off-by: Greg Kurz <address@hidden>
Signed-off-by: Michael Roth <address@hidden>
---
hw/9pfs/9p-util.c | 57 +++++++++++++++++++++++++++++++++++++++++++++++++++
hw/9pfs/9p-util.h | 50 ++++++++++++++++++++++++++++++++++++++++++++
hw/9pfs/Makefile.objs | 2 +-
3 files changed, 108 insertions(+), 1 deletion(-)
create mode 100644 hw/9pfs/9p-util.c
create mode 100644 hw/9pfs/9p-util.h
diff --git a/hw/9pfs/9p-util.c b/hw/9pfs/9p-util.c
new file mode 100644
index 0000000..54134b0
--- /dev/null
+++ b/hw/9pfs/9p-util.c
@@ -0,0 +1,57 @@
+/*
+ * 9p utilities
+ *
+ * Copyright IBM, Corp. 2017
+ *
+ * Authors:
+ * Greg Kurz <address@hidden>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ */
+
+#include "qemu/osdep.h"
+#include "9p-util.h"
+
+int relative_openat_nofollow(int dirfd, const char *path, int flags,
+ mode_t mode)
+{
+ int fd;
+
+ fd = dup(dirfd);
+ if (fd == -1) {
+ return -1;
+ }
+
+ while (*path) {
+ const char *c;
+ int next_fd;
+ char *head;
+
+ /* Only relative paths without consecutive slashes */
+ assert(path[0] != '/');
+
+ head = g_strdup(path);
+ c = strchr(path, '/');
+ if (c) {
+ head[c - path] = 0;
+ next_fd = openat_dir(fd, head);
+ } else {
+ next_fd = openat_file(fd, head, flags, mode);
+ }
+ g_free(head);
+ if (next_fd == -1) {
+ close_preserve_errno(fd);
+ return -1;
+ }
+ close(fd);
+ fd = next_fd;
+
+ if (!c) {
+ break;
+ }
+ path = c + 1;
+ }
+
+ return fd;
+}
diff --git a/hw/9pfs/9p-util.h b/hw/9pfs/9p-util.h
new file mode 100644
index 0000000..e80b5a5
--- /dev/null
+++ b/hw/9pfs/9p-util.h
@@ -0,0 +1,50 @@
+/*
+ * 9p utilities
+ *
+ * Copyright IBM, Corp. 2017
+ *
+ * Authors:
+ * Greg Kurz <address@hidden>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ */
+
+#ifndef QEMU_9P_UTIL_H
+#define QEMU_9P_UTIL_H
+
+static inline void close_preserve_errno(int fd)
+{
+ int serrno = errno;
+ close(fd);
+ errno = serrno;
+}
+
+static inline int openat_dir(int dirfd, const char *name)
+{
+ return openat(dirfd, name, O_DIRECTORY | O_RDONLY | O_PATH);
+}
+
+static inline int openat_file(int dirfd, const char *name, int flags,
+ mode_t mode)
+{
+ int fd, serrno, ret;
+
+ fd = openat(dirfd, name, flags | O_NOFOLLOW | O_NOCTTY | O_NONBLOCK,
+ mode);
+ if (fd == -1) {
+ return -1;
+ }
+
+ serrno = errno;
+ /* O_NONBLOCK was only needed to open the file. Let's drop it. */
+ ret = fcntl(fd, F_SETFL, flags);
+ assert(!ret);
+ errno = serrno;
+ return fd;
+}
+
+int relative_openat_nofollow(int dirfd, const char *path, int flags,
+ mode_t mode);
+
+#endif
diff --git a/hw/9pfs/Makefile.objs b/hw/9pfs/Makefile.objs
index da0ae0c..32197e6 100644
--- a/hw/9pfs/Makefile.objs
+++ b/hw/9pfs/Makefile.objs
@@ -1,4 +1,4 @@
-common-obj-y = 9p.o
+common-obj-y = 9p.o 9p-util.o
common-obj-y += 9p-local.o 9p-xattr.o
common-obj-y += 9p-xattr-user.o 9p-posix-acl.o
common-obj-y += coth.o cofs.o codir.o cofile.o
--
2.7.4
- [Qemu-stable] [PATCH 32/81] 9pfs: don't use AT_EMPTY_PATH in local_set_cred_passthrough(), (continued)
- [Qemu-stable] [PATCH 32/81] 9pfs: don't use AT_EMPTY_PATH in local_set_cred_passthrough(), Michael Roth, 2017/03/20
- [Qemu-stable] [PATCH 52/81] ui: use evdev keymap when running under wayland, Michael Roth, 2017/03/20
- [Qemu-stable] [PATCH 54/81] block/iscsi: avoid data corruption with cache=writeback, Michael Roth, 2017/03/20
- [Qemu-stable] [PATCH 57/81] cpu-exec: fix icount out-of-bounds access, Michael Roth, 2017/03/20
- [Qemu-stable] [PATCH 59/81] target/s390x: use "qemu" cpu model in user mode, Michael Roth, 2017/03/20
- [Qemu-stable] [PATCH 64/81] vnc: do not disconnect on EAGAIN, Michael Roth, 2017/03/20
- [Qemu-stable] [PATCH 68/81] apic: reset apic_delivered global variable on machine reset, Michael Roth, 2017/03/20
- [Qemu-stable] [PATCH 73/81] eth: Extend vlan stripping functions, Michael Roth, 2017/03/20
- [Qemu-stable] [PATCH 40/81] pc: fix crash in rtc_set_memory() if initial cpu is marked as hotplugged, Michael Roth, 2017/03/20
- [Qemu-stable] [PATCH 47/81] display: cirrus: ignore source pitch value as needed in blit_is_unsafe, Michael Roth, 2017/03/20
- [Qemu-stable] [PATCH 04/81] 9pfs: introduce relative_openat_nofollow() helper,
Michael Roth <=
- [Qemu-stable] [PATCH 51/81] tcg/aarch64: Fix tcg_out_movi, Michael Roth, 2017/03/20
- [Qemu-stable] [PATCH 60/81] s390x/kvm: fix small race reboot vs. cmma, Michael Roth, 2017/03/20
- [Qemu-stable] [PATCH 56/81] cirrus: fix oob access issue (CVE-2017-2615), Michael Roth, 2017/03/20
- [Qemu-stable] [PATCH 58/81] ahci: advertise HOST_CAP_64, Michael Roth, 2017/03/20
- [Qemu-stable] [PATCH 53/81] virtio: fix up max size checks, Michael Roth, 2017/03/20
- [Qemu-stable] [PATCH 62/81] block/nfs: fix naming of runtime opts, Michael Roth, 2017/03/20
- [Qemu-stable] [PATCH 67/81] target/sparc: Restore ldstub of odd asis, Michael Roth, 2017/03/20
- [Qemu-stable] [PATCH 75/81] NetRxPkt: Do not try to pull more data than present, Michael Roth, 2017/03/20
- [Qemu-stable] [PATCH 81/81] thread-pool: add missing qemu_bh_cancel in completion function, Michael Roth, 2017/03/20