[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH 20/29] 9pfs: local: rename: use renameat
From: |
Greg Kurz |
Subject: |
[Qemu-devel] [PATCH 20/29] 9pfs: local: rename: use renameat |
Date: |
Mon, 20 Feb 2017 15:41:56 +0100 |
User-agent: |
StGit/0.17.1-20-gc0b1b-dirty |
The local_rename() callback is vulnerable to symlink attacks because it
uses rename() which follows symbolic links in all path elements but the
rightmost one.
This patch simply transforms local_rename() into a wrapper around
local_renameat() which is symlink-attack safe.
This partly fixes CVE-2016-9602.
Signed-off-by: Greg Kurz <address@hidden>
---
hw/9pfs/9p-local.c | 57 +++++++++++++++++++++++++---------------------------
1 file changed, 27 insertions(+), 30 deletions(-)
diff --git a/hw/9pfs/9p-local.c b/hw/9pfs/9p-local.c
index 07b7110d87d7..15e746ede86a 100644
--- a/hw/9pfs/9p-local.c
+++ b/hw/9pfs/9p-local.c
@@ -959,36 +959,6 @@ static int local_truncate(FsContext *ctx, V9fsPath
*fs_path, off_t size)
return ret;
}
-static int local_rename(FsContext *ctx, const char *oldpath,
- const char *newpath)
-{
- int err;
- char *buffer, *buffer1;
-
- if (ctx->export_flags & V9FS_SM_MAPPED_FILE) {
- err = local_create_mapped_attr_dir(ctx, newpath);
- if (err < 0) {
- return err;
- }
- /* rename the .virtfs_metadata files */
- buffer = local_mapped_attr_path(ctx, oldpath);
- buffer1 = local_mapped_attr_path(ctx, newpath);
- err = rename(buffer, buffer1);
- g_free(buffer);
- g_free(buffer1);
- if (err < 0 && errno != ENOENT) {
- return err;
- }
- }
-
- buffer = rpath(ctx, oldpath);
- buffer1 = rpath(ctx, newpath);
- err = rename(buffer, buffer1);
- g_free(buffer);
- g_free(buffer1);
- return err;
-}
-
static int local_chown(FsContext *fs_ctx, V9fsPath *fs_path, FsCred *credp)
{
char *buffer;
@@ -1250,6 +1220,33 @@ out:
return ret;
}
+static void v9fs_path_init_dirname(V9fsPath *path, const char *str)
+{
+ path->data = g_path_get_dirname(str);
+ path->size = strlen(path->data) + 1;
+}
+
+static int local_rename(FsContext *ctx, const char *oldpath,
+ const char *newpath)
+{
+ int err;
+ char *oname = g_path_get_basename(oldpath);
+ char *nname = g_path_get_basename(newpath);
+ V9fsPath olddir, newdir;
+
+ v9fs_path_init_dirname(&olddir, oldpath);
+ v9fs_path_init_dirname(&newdir, newpath);
+
+ err = local_renameat(ctx, &olddir, oname, &newdir, nname);
+
+ v9fs_path_free(&newdir);
+ v9fs_path_free(&olddir);
+ g_free(nname);
+ g_free(oname);
+
+ return err;
+}
+
static int local_unlinkat(FsContext *ctx, V9fsPath *dir,
const char *name, int flags)
{
- [Qemu-devel] [PATCH 15/29] 9pfs: local: statfs: don't follow symlinks, (continued)
- [Qemu-devel] [PATCH 15/29] 9pfs: local: statfs: don't follow symlinks, Greg Kurz, 2017/02/20
- [Qemu-devel] [PATCH 16/29] 9pfs: local: truncate: don't follow symlinks, Greg Kurz, 2017/02/20
- [Qemu-devel] [PATCH 17/29] 9pfs: local: readlink: don't follow symlinks, Greg Kurz, 2017/02/20
- [Qemu-devel] [PATCH 18/29] 9pfs: local: lstat: don't follow symlinks, Greg Kurz, 2017/02/20
- [Qemu-devel] [PATCH 19/29] 9pfs: local: renameat: don't follow symlinks, Greg Kurz, 2017/02/20
- [Qemu-devel] [PATCH 20/29] 9pfs: local: rename: use renameat,
Greg Kurz <=
- [Qemu-devel] [PATCH 21/29] 9pfs: local: improve error handling in link op, Greg Kurz, 2017/02/20
- [Qemu-devel] [PATCH 22/29] 9pfs: local: link: don't follow symlinks, Greg Kurz, 2017/02/20
- [Qemu-devel] [PATCH 23/29] 9pfs: local: chmod: don't follow symlinks, Greg Kurz, 2017/02/20