[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-devel] [PATCH stable-1.1] qga: set umask 0077 when daemonizing
Re: [Qemu-devel] [PATCH stable-1.1] qga: set umask 0077 when daemonizing (CVE-2013-2007)
Mon, 27 May 2013 02:19:23 +0200
Mozilla/5.0 (X11; Linux x86_64; rv:17.0) Gecko/20130329 Thunderbird/17.0.5
Am 27.05.2013 02:11, schrieb Laszlo Ersek:
> On 05/26/13 15:34, Andreas Färber wrote:
>> From: Laszlo Ersek <address@hidden>
>> The qemu guest agent creates a bunch of files with insecure permissions
>> when started in daemon mode. For example:
>> -rw-rw-rw- 1 root root /var/log/qemu-ga.log
>> -rw-rw-rw- 1 root root /var/run/qga.state
>> -rw-rw-rw- 1 root root /var/log/qga-fsfreeze-hook.log
>> In addition, at least all files created with the "guest-file-open" QMP
>> command, and all files created with shell output redirection (or
>> otherwise) by utilities invoked by the fsfreeze hook script are affected.
>> For now mask all file mode bits for "group" and "others" in
>> Temporarily, for compatibility reasons, stick with the 0666 file-mode in
>> case of files newly created by the "guest-file-open" QMP call. Do so
>> without changing the umask temporarily.
>> Signed-off-by: Laszlo Ersek <address@hidden>
>> Signed-off-by: Anthony Liguori <address@hidden>
>> (cherry picked from commit c689b4f1bac352dcfd6ecb9a1d45337de0f1de67)
>> [AF: Use error_set() instead of error_setg*()]
>> Signed-off-by: Andreas Färber <address@hidden>
>> qemu-ga.c | 2 +-
>> qga/commands-posix.c | 117
>> 2 files changed, 115 insertions(+), 4 deletions(-)
> Looks good to me.
> Do you plan to backport
> 8fe6bbc qga: distinguish binary modes in "guest_file_open_modes" map
> 2b72001 qga: unlink just created guest-file if fchmod() or fdopen()
> fails on it
> too? These are considered polish for the CVE fix.
I did backport both to openSUSE 12.2 - they apply without conflicts. :)
I mainly posted this one to check if there are better QERRs to use.
> Also, a side-note: existing world-writable log files etc. are not
> recreated nor have their modes changed, so maybe a release note or some
> such would be useful for admins ("delete your previous logfile &
> optional unix domain socket, or change their modes manually").
Feel free to add a note to the 1.5 Release Notes - it can then be copied
to the previous releases we backport this fix to.
Apart from 1.1 I backported to our 1.3 branch.
SUSE LINUX Products GmbH, Maxfeldstr. 5, 90409 Nürnberg, Germany
GF: Jeff Hawn, Jennifer Guild, Felix Imendörffer; HRB 16746 AG Nürnberg