[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PATCH 053/104] virtiofsd: Drop CAP_FSETID if client asked for it
From: |
Dr. David Alan Gilbert (git) |
Subject: |
[PATCH 053/104] virtiofsd: Drop CAP_FSETID if client asked for it |
Date: |
Thu, 12 Dec 2019 16:38:13 +0000 |
From: Vivek Goyal <address@hidden>
If client requested killing setuid/setgid bits on file being written, drop
CAP_FSETID capability so that setuid/setgid bits are cleared upon write
automatically.
pjdfstest chown/12.t needs this.
Signed-off-by: Vivek Goyal <address@hidden>
dgilbert: reworked for libcap-ng
---
tools/virtiofsd/passthrough_ll.c | 105 +++++++++++++++++++++++++++++++
1 file changed, 105 insertions(+)
diff --git a/tools/virtiofsd/passthrough_ll.c b/tools/virtiofsd/passthrough_ll.c
index 6a09b28608..ab318a6f36 100644
--- a/tools/virtiofsd/passthrough_ll.c
+++ b/tools/virtiofsd/passthrough_ll.c
@@ -201,6 +201,91 @@ static int load_capng(void)
return 0;
}
+/*
+ * Helpers for dropping and regaining effective capabilities. Returns 0
+ * on success, error otherwise
+ */
+static int drop_effective_cap(const char *cap_name, bool *cap_dropped)
+{
+ int cap, ret;
+
+ cap = capng_name_to_capability(cap_name);
+ if (cap < 0) {
+ ret = errno;
+ fuse_log(FUSE_LOG_ERR, "capng_name_to_capability(%s) failed:%s\n",
+ cap_name, strerror(errno));
+ goto out;
+ }
+
+ if (load_capng()) {
+ ret = errno;
+ fuse_log(FUSE_LOG_ERR, "load_capng() failed\n");
+ goto out;
+ }
+
+ /* We dont have this capability in effective set already. */
+ if (!capng_have_capability(CAPNG_EFFECTIVE, cap)) {
+ ret = 0;
+ goto out;
+ }
+
+ if (capng_update(CAPNG_DROP, CAPNG_EFFECTIVE, cap)) {
+ ret = errno;
+ fuse_log(FUSE_LOG_ERR, "capng_update(DROP,) failed\n");
+ goto out;
+ }
+
+ if (capng_apply(CAPNG_SELECT_CAPS)) {
+ ret = errno;
+ fuse_log(FUSE_LOG_ERR, "drop:capng_apply() failed\n");
+ goto out;
+ }
+
+ ret = 0;
+ if (cap_dropped) {
+ *cap_dropped = true;
+ }
+
+out:
+ return ret;
+}
+
+static int gain_effective_cap(const char *cap_name)
+{
+ int cap;
+ int ret = 0;
+
+ cap = capng_name_to_capability(cap_name);
+ if (cap < 0) {
+ ret = errno;
+ fuse_log(FUSE_LOG_ERR, "capng_name_to_capability(%s) failed:%s\n",
+ cap_name, strerror(errno));
+ goto out;
+ }
+
+ if (load_capng()) {
+ ret = errno;
+ fuse_log(FUSE_LOG_ERR, "load_capng() failed\n");
+ goto out;
+ }
+
+ if (capng_update(CAPNG_ADD, CAPNG_EFFECTIVE, cap)) {
+ ret = errno;
+ fuse_log(FUSE_LOG_ERR, "capng_update(ADD,) failed\n");
+ goto out;
+ }
+
+ if (capng_apply(CAPNG_SELECT_CAPS)) {
+ ret = errno;
+ fuse_log(FUSE_LOG_ERR, "gain:capng_apply() failed\n");
+ goto out;
+ }
+ ret = 0;
+
+out:
+ return ret;
+}
+
static void lo_map_init(struct lo_map *map)
{
map->elems = NULL;
@@ -1559,6 +1644,7 @@ static void lo_write_buf(fuse_req_t req, fuse_ino_t ino,
(void)ino;
ssize_t res;
struct fuse_bufvec out_buf = FUSE_BUFVEC_INIT(fuse_buf_size(in_buf));
+ bool cap_fsetid_dropped = false;
out_buf.buf[0].flags = FUSE_BUF_IS_FD | FUSE_BUF_FD_SEEK;
out_buf.buf[0].fd = lo_fi_fd(req, fi);
@@ -1570,12 +1656,31 @@ static void lo_write_buf(fuse_req_t req, fuse_ino_t ino,
out_buf.buf[0].size, (unsigned long)off);
}
+ /*
+ * If kill_priv is set, drop CAP_FSETID which should lead to kernel
+ * clearing setuid/setgid on file.
+ */
+ if (fi->kill_priv) {
+ res = drop_effective_cap("FSETID", &cap_fsetid_dropped);
+ if (res != 0) {
+ fuse_reply_err(req, res);
+ return;
+ }
+ }
+
res = fuse_buf_copy(&out_buf, in_buf, 0);
if (res < 0) {
fuse_reply_err(req, -res);
} else {
fuse_reply_write(req, (size_t)res);
}
+
+ if (cap_fsetid_dropped) {
+ res = gain_effective_cap("FSETID");
+ if (res) {
+ fuse_log(FUSE_LOG_ERR, "Failed to gain CAP_FSETID\n");
+ }
+ }
}
static void lo_statfs(fuse_req_t req, fuse_ino_t ino)
--
2.23.0
- [PATCH 044/104] virtiofsd: prevent ".." escape in lo_do_lookup(), (continued)
- [PATCH 044/104] virtiofsd: prevent ".." escape in lo_do_lookup(), Dr. David Alan Gilbert (git), 2019/12/12
- [PATCH 045/104] virtiofsd: prevent ".." escape in lo_do_readdir(), Dr. David Alan Gilbert (git), 2019/12/12
- [PATCH 043/104] virtiofsd: check input buffer size in fuse_lowlevel.c ops, Dr. David Alan Gilbert (git), 2019/12/12
- [PATCH 046/104] virtiofsd: use /proc/self/fd/ O_PATH file descriptor, Dr. David Alan Gilbert (git), 2019/12/12
- [PATCH 047/104] virtiofsd: sandbox mount namespace, Dr. David Alan Gilbert (git), 2019/12/12
- [PATCH 048/104] virtiofsd: move to an empty network namespace, Dr. David Alan Gilbert (git), 2019/12/12
- [PATCH 049/104] virtiofsd: move to a new pid namespace, Dr. David Alan Gilbert (git), 2019/12/12
- [PATCH 050/104] virtiofsd: add seccomp whitelist, Dr. David Alan Gilbert (git), 2019/12/12
- [PATCH 051/104] virtiofsd: Parse flag FUSE_WRITE_KILL_PRIV, Dr. David Alan Gilbert (git), 2019/12/12
- [PATCH 052/104] virtiofsd: cap-ng helpers, Dr. David Alan Gilbert (git), 2019/12/12
- [PATCH 053/104] virtiofsd: Drop CAP_FSETID if client asked for it,
Dr. David Alan Gilbert (git) <=
- [PATCH 054/104] virtiofsd: set maximum RLIMIT_NOFILE limit, Dr. David Alan Gilbert (git), 2019/12/12
- [PATCH 057/104] virtiofsd: add --syslog command-line option, Dr. David Alan Gilbert (git), 2019/12/12
- [PATCH 055/104] virtiofsd: fix libfuse information leaks, Dr. David Alan Gilbert (git), 2019/12/12
- [PATCH 056/104] virtiofsd: add security guide document, Dr. David Alan Gilbert (git), 2019/12/12
- [PATCH 059/104] virtiofsd: Add ID to the log with FUSE_LOG_DEBUG level, Dr. David Alan Gilbert (git), 2019/12/12
- [PATCH 060/104] virtiofsd: Add timestamp to the log with FUSE_LOG_DEBUG level, Dr. David Alan Gilbert (git), 2019/12/12
- [PATCH 058/104] virtiofsd: print log only when priority is high enough, Dr. David Alan Gilbert (git), 2019/12/12
- [PATCH 061/104] virtiofsd: Handle reinit, Dr. David Alan Gilbert (git), 2019/12/12
- [PATCH 062/104] virtiofsd: Handle hard reboot, Dr. David Alan Gilbert (git), 2019/12/12
- [PATCH 063/104] virtiofsd: Kill threads when queues are stopped, Dr. David Alan Gilbert (git), 2019/12/12