[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PATCH 21/25] virtiofsd: Drop CAP_FSETID if client asked for it
From: |
Dr. David Alan Gilbert (git) |
Subject: |
[PATCH 21/25] virtiofsd: Drop CAP_FSETID if client asked for it |
Date: |
Thu, 24 Oct 2019 12:27:14 +0100 |
From: Vivek Goyal <address@hidden>
If client requested killing setuid/setgid bits on file being written, drop
CAP_FSETID capability so that setuid/setgid bits are cleared upon write
automatically.
pjdfstest chown/12.t needs this.
Signed-off-by: Vivek Goyal <address@hidden>
Reviewed-by: Dr. David Alan Gilbert <address@hidden>
---
contrib/virtiofsd/Makefile.objs | 2 +
contrib/virtiofsd/passthrough_ll.c | 127 +++++++++++++++++++++++++++++
2 files changed, 129 insertions(+)
diff --git a/contrib/virtiofsd/Makefile.objs b/contrib/virtiofsd/Makefile.objs
index 941b19f18e..25f1e8dd73 100644
--- a/contrib/virtiofsd/Makefile.objs
+++ b/contrib/virtiofsd/Makefile.objs
@@ -11,3 +11,5 @@ virtiofsd-obj-y = buffer.o \
seccomp.o-cflags := $(SECCOMP_CFLAGS)
seccomp.o-libs := $(SECCOMP_LIBS)
+
+passthrough_ll.o-libs += -lcap
diff --git a/contrib/virtiofsd/passthrough_ll.c
b/contrib/virtiofsd/passthrough_ll.c
index 93873bf6f4..fe46b25fb6 100644
--- a/contrib/virtiofsd/passthrough_ll.c
+++ b/contrib/virtiofsd/passthrough_ll.c
@@ -51,6 +51,7 @@
#include <sys/file.h>
#include <sys/syscall.h>
#include <sys/xattr.h>
+#include <sys/capability.h>
#include <sys/mount.h>
#include <sys/types.h>
#include <sys/wait.h>
@@ -174,6 +175,115 @@ static struct lo_data *lo_data(fuse_req_t req)
return (struct lo_data *) fuse_req_userdata(req);
}
+/* Helpers for dropping and regaining effective capabilities. Returns 0
+ * on success, error otherwise */
+static int drop_effective_cap(const char *cap_name, bool *cap_dropped)
+{
+ cap_t caps;
+ cap_value_t cap;
+ cap_flag_value_t cap_value;
+ int ret = 0;
+
+ ret = cap_from_name(cap_name, &cap);
+ if (ret == -1) {
+ ret = errno;
+ fuse_log(FUSE_LOG_ERR, "cap_from_name(%s) failed:%s\n",
cap_name,
+ strerror(errno));
+ goto out;
+ }
+
+ if (!CAP_IS_SUPPORTED(cap)) {
+ fuse_log(FUSE_LOG_ERR, "capability(%s) is not supported\n",
cap_name);
+ return EINVAL;
+ }
+
+ caps = cap_get_proc();
+ if (caps == NULL) {
+ ret = errno;
+ fuse_log(FUSE_LOG_ERR, "cap_get_proc() failed\n");
+ goto out;
+ }
+
+ if (cap_get_flag(caps, cap, CAP_EFFECTIVE, &cap_value) == -1) {
+ ret = errno;
+ fuse_log(FUSE_LOG_ERR, "cap_get_flag() failed\n");
+ goto out_cap_free;
+ }
+
+ /* We dont have this capability in effective set already. */
+ if (cap_value == CAP_CLEAR) {
+ ret = 0;
+ goto out_cap_free;
+ }
+
+ if (cap_set_flag(caps, CAP_EFFECTIVE, 1, &cap, CAP_CLEAR) == -1) {
+ ret = errno;
+ fuse_log(FUSE_LOG_ERR, "cap_set_flag() failed\n");
+ goto out_cap_free;
+ }
+
+ if (cap_set_proc(caps) == -1) {
+ ret = errno;
+ fuse_log(FUSE_LOG_ERR, "cap_set_procs() failed\n");
+ goto out_cap_free;
+ }
+
+ ret = 0;
+ if (cap_dropped)
+ *cap_dropped = true;
+
+out_cap_free:
+ cap_free(caps);
+out:
+ return ret;
+}
+
+static int gain_effective_cap(const char *cap_name)
+{
+ cap_t caps;
+ cap_value_t cap;
+ int ret = 0;
+
+ ret = cap_from_name(cap_name, &cap);
+ if (ret == -1) {
+ ret = errno;
+ fuse_log(FUSE_LOG_ERR, "cap_from_name(%s) failed:%s\n",
cap_name,
+ strerror(errno));
+ goto out;
+ }
+
+ if (!CAP_IS_SUPPORTED(cap)) {
+ fuse_log(FUSE_LOG_ERR, "capability(%s) is not supported\n",
cap_name);
+ return EINVAL;
+ }
+
+ caps = cap_get_proc();
+ if (caps == NULL) {
+ ret = errno;
+ fuse_log(FUSE_LOG_ERR, "cap_get_proc() failed\n");
+ goto out;
+ }
+
+
+ if (cap_set_flag(caps, CAP_EFFECTIVE, 1, &cap, CAP_SET) == -1) {
+ ret = errno;
+ fuse_log(FUSE_LOG_ERR, "cap_set_flag() failed\n");
+ goto out_cap_free;
+ }
+
+ if (cap_set_proc(caps) == -1) {
+ ret = errno;
+ fuse_log(FUSE_LOG_ERR, "cap_set_procs() failed\n");
+ goto out_cap_free;
+ }
+ ret = 0;
+
+out_cap_free:
+ cap_free(caps);
+out:
+ return ret;
+}
+
static void lo_map_init(struct lo_map *map)
{
map->elems = NULL;
@@ -1447,6 +1557,7 @@ static void lo_write_buf(fuse_req_t req, fuse_ino_t ino,
(void) ino;
ssize_t res;
struct fuse_bufvec out_buf = FUSE_BUFVEC_INIT(fuse_buf_size(in_buf));
+ bool cap_fsetid_dropped = false;
out_buf.buf[0].flags = FUSE_BUF_IS_FD | FUSE_BUF_FD_SEEK;
out_buf.buf[0].fd = lo_fi_fd(req, fi);
@@ -1456,11 +1567,27 @@ static void lo_write_buf(fuse_req_t req, fuse_ino_t ino,
fuse_log(FUSE_LOG_DEBUG, "lo_write(ino=%" PRIu64 ", size=%zd,
off=%lu)\n",
ino, out_buf.buf[0].size, (unsigned long) off);
+ /*
+ * If kill_priv is set, drop CAP_FSETID which should lead to kernel
+ * clearing setuid/setgid on file.
+ */
+ if (fi->kill_priv) {
+ res = drop_effective_cap("cap_fsetid", &cap_fsetid_dropped);
+ if (res != 0)
+ fuse_reply_err(req, res);
+ }
+
res = fuse_buf_copy(&out_buf, in_buf, 0);
if(res < 0)
fuse_reply_err(req, -res);
else
fuse_reply_write(req, (size_t) res);
+
+ if (cap_fsetid_dropped) {
+ res = gain_effective_cap("cap_fsetid");
+ if (res)
+ fuse_log(FUSE_LOG_ERR, "Failed to gain CAP_FSETID\n");
+ }
}
static void lo_statfs(fuse_req_t req, fuse_ino_t ino)
--
2.23.0
- [PATCH 11/25] virtiofsd: validate input buffer sizes in do_write_buf(), (continued)
- [PATCH 11/25] virtiofsd: validate input buffer sizes in do_write_buf(), Dr. David Alan Gilbert (git), 2019/10/24
- [PATCH 12/25] virtiofsd: check input buffer size in fuse_lowlevel.c ops, Dr. David Alan Gilbert (git), 2019/10/24
- [PATCH 15/25] virtiofsd: use /proc/self/fd/ O_PATH file descriptor, Dr. David Alan Gilbert (git), 2019/10/24
- [PATCH 13/25] virtiofsd: prevent ".." escape in lo_do_lookup(), Dr. David Alan Gilbert (git), 2019/10/24
- [PATCH 14/25] virtiofsd: prevent ".." escape in lo_do_readdir(), Dr. David Alan Gilbert (git), 2019/10/24
- [PATCH 16/25] virtiofsd: sandbox mount namespace, Dr. David Alan Gilbert (git), 2019/10/24
- [PATCH 17/25] virtiofsd: move to an empty network namespace, Dr. David Alan Gilbert (git), 2019/10/24
- [PATCH 18/25] virtiofsd: move to a new pid namespace, Dr. David Alan Gilbert (git), 2019/10/24
- [PATCH 19/25] virtiofsd: add seccomp whitelist, Dr. David Alan Gilbert (git), 2019/10/24
- [PATCH 20/25] virtiofsd: Parse flag FUSE_WRITE_KILL_PRIV, Dr. David Alan Gilbert (git), 2019/10/24
- [PATCH 21/25] virtiofsd: Drop CAP_FSETID if client asked for it,
Dr. David Alan Gilbert (git) <=
- [PATCH 22/25] virtiofsd: set maximum RLIMIT_NOFILE limit, Dr. David Alan Gilbert (git), 2019/10/24
- [PATCH 23/25] virtiofsd: add security guide document, Dr. David Alan Gilbert (git), 2019/10/24
- [PATCH 24/25] virtiofsd: add --syslog command-line option, Dr. David Alan Gilbert (git), 2019/10/24
- [PATCH 25/25] virtiofsd: print log only when priority is high enough, Dr. David Alan Gilbert (git), 2019/10/24