cryptospore / rpms / qemu-kvm

Forked from rpms/qemu-kvm 2 years ago
Clone
902636
From f62613d8058bcb60b26727d980a37537103b0033 Mon Sep 17 00:00:00 2001
902636
From: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
902636
Date: Mon, 27 Jan 2020 19:01:32 +0100
902636
Subject: [PATCH 061/116] virtiofsd: cap-ng helpers
902636
MIME-Version: 1.0
902636
Content-Type: text/plain; charset=UTF-8
902636
Content-Transfer-Encoding: 8bit
902636
902636
RH-Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
902636
Message-id: <20200127190227.40942-58-dgilbert@redhat.com>
902636
Patchwork-id: 93512
902636
O-Subject: [RHEL-AV-8.2 qemu-kvm PATCH 057/112] virtiofsd: cap-ng helpers
902636
Bugzilla: 1694164
902636
RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
902636
RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
902636
RH-Acked-by: Sergio Lopez Pascual <slp@redhat.com>
902636
902636
From: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
902636
902636
libcap-ng reads /proc during capng_get_caps_process, and virtiofsd's
902636
sandboxing doesn't have /proc mounted; thus we have to do the
902636
caps read before we sandbox it and save/restore the state.
902636
902636
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
902636
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
902636
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
902636
(cherry picked from commit 2405f3c0d19eb4d516a88aa4e5c54e5f9c6bbea3)
902636
Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
902636
---
902636
 Makefile                         |  4 +--
902636
 tools/virtiofsd/passthrough_ll.c | 72 ++++++++++++++++++++++++++++++++++++++++
902636
 2 files changed, 74 insertions(+), 2 deletions(-)
902636
902636
diff --git a/Makefile b/Makefile
902636
index 6879a06..ff05c30 100644
902636
--- a/Makefile
902636
+++ b/Makefile
902636
@@ -330,7 +330,7 @@ endif
902636
 endif
902636
 endif
902636
 
902636
-ifeq ($(CONFIG_LINUX)$(CONFIG_SECCOMP),yy)
902636
+ifeq ($(CONFIG_LINUX)$(CONFIG_SECCOMP)$(CONFIG_LIBCAP_NG),yyy)
902636
 HELPERS-y += virtiofsd$(EXESUF)
902636
 vhost-user-json-y += tools/virtiofsd/50-qemu-virtiofsd.json
902636
 endif
902636
@@ -682,7 +682,7 @@ rdmacm-mux$(EXESUF): $(rdmacm-mux-obj-y) $(COMMON_LDADDS)
902636
 	$(call LINK, $^)
902636
 
902636
 # relies on Linux-specific syscalls
902636
-ifeq ($(CONFIG_LINUX)$(CONFIG_SECCOMP),yy)
902636
+ifeq ($(CONFIG_LINUX)$(CONFIG_SECCOMP)$(CONFIG_LIBCAP_NG),yyy)
902636
 virtiofsd$(EXESUF): $(virtiofsd-obj-y) libvhost-user.a $(COMMON_LDADDS)
902636
 	$(call LINK, $^)
902636
 endif
902636
diff --git a/tools/virtiofsd/passthrough_ll.c b/tools/virtiofsd/passthrough_ll.c
902636
index bd8925b..97e7c75 100644
902636
--- a/tools/virtiofsd/passthrough_ll.c
902636
+++ b/tools/virtiofsd/passthrough_ll.c
902636
@@ -39,6 +39,7 @@
902636
 #include "fuse_virtio.h"
902636
 #include "fuse_lowlevel.h"
902636
 #include <assert.h>
902636
+#include <cap-ng.h>
902636
 #include <dirent.h>
902636
 #include <errno.h>
902636
 #include <inttypes.h>
902636
@@ -139,6 +140,13 @@ static const struct fuse_opt lo_opts[] = {
902636
 
902636
 static void unref_inode(struct lo_data *lo, struct lo_inode *inode, uint64_t n);
902636
 
902636
+static struct {
902636
+    pthread_mutex_t mutex;
902636
+    void *saved;
902636
+} cap;
902636
+/* That we loaded cap-ng in the current thread from the saved */
902636
+static __thread bool cap_loaded = 0;
902636
+
902636
 static struct lo_inode *lo_find(struct lo_data *lo, struct stat *st);
902636
 
902636
 static int is_dot_or_dotdot(const char *name)
902636
@@ -162,6 +170,37 @@ static struct lo_data *lo_data(fuse_req_t req)
902636
     return (struct lo_data *)fuse_req_userdata(req);
902636
 }
902636
 
902636
+/*
902636
+ * Load capng's state from our saved state if the current thread
902636
+ * hadn't previously been loaded.
902636
+ * returns 0 on success
902636
+ */
902636
+static int load_capng(void)
902636
+{
902636
+    if (!cap_loaded) {
902636
+        pthread_mutex_lock(&cap.mutex);
902636
+        capng_restore_state(&cap.saved);
902636
+        /*
902636
+         * restore_state free's the saved copy
902636
+         * so make another.
902636
+         */
902636
+        cap.saved = capng_save_state();
902636
+        if (!cap.saved) {
902636
+            fuse_log(FUSE_LOG_ERR, "capng_save_state (thread)\n");
902636
+            return -EINVAL;
902636
+        }
902636
+        pthread_mutex_unlock(&cap.mutex);
902636
+
902636
+        /*
902636
+         * We want to use the loaded state for our pid,
902636
+         * not the original
902636
+         */
902636
+        capng_setpid(syscall(SYS_gettid));
902636
+        cap_loaded = true;
902636
+    }
902636
+    return 0;
902636
+}
902636
+
902636
 static void lo_map_init(struct lo_map *map)
902636
 {
902636
     map->elems = NULL;
902636
@@ -2024,6 +2063,35 @@ static void setup_namespaces(struct lo_data *lo, struct fuse_session *se)
902636
 }
902636
 
902636
 /*
902636
+ * Capture the capability state, we'll need to restore this for individual
902636
+ * threads later; see load_capng.
902636
+ */
902636
+static void setup_capng(void)
902636
+{
902636
+    /* Note this accesses /proc so has to happen before the sandbox */
902636
+    if (capng_get_caps_process()) {
902636
+        fuse_log(FUSE_LOG_ERR, "capng_get_caps_process\n");
902636
+        exit(1);
902636
+    }
902636
+    pthread_mutex_init(&cap.mutex, NULL);
902636
+    pthread_mutex_lock(&cap.mutex);
902636
+    cap.saved = capng_save_state();
902636
+    if (!cap.saved) {
902636
+        fuse_log(FUSE_LOG_ERR, "capng_save_state\n");
902636
+        exit(1);
902636
+    }
902636
+    pthread_mutex_unlock(&cap.mutex);
902636
+}
902636
+
902636
+static void cleanup_capng(void)
902636
+{
902636
+    free(cap.saved);
902636
+    cap.saved = NULL;
902636
+    pthread_mutex_destroy(&cap.mutex);
902636
+}
902636
+
902636
+
902636
+/*
902636
  * Make the source directory our root so symlinks cannot escape and no other
902636
  * files are accessible.  Assumes unshare(CLONE_NEWNS) was already called.
902636
  */
902636
@@ -2216,12 +2284,16 @@ int main(int argc, char *argv[])
902636
 
902636
     fuse_daemonize(opts.foreground);
902636
 
902636
+    /* Must be before sandbox since it wants /proc */
902636
+    setup_capng();
902636
+
902636
     setup_sandbox(&lo, se);
902636
 
902636
     /* Block until ctrl+c or fusermount -u */
902636
     ret = virtio_loop(se);
902636
 
902636
     fuse_session_unmount(se);
902636
+    cleanup_capng();
902636
 err_out3:
902636
     fuse_remove_signal_handlers(se);
902636
 err_out2:
902636
-- 
902636
1.8.3.1
902636