From 9e7a97817e2f53416d5f87f4e322ce163af387b5 Mon Sep 17 00:00:00 2001

Message-Id: <9e7a97817e2f53416d5f87f4e322ce163af387b5@dist-git>

From: "Daniel P. Berrange" <berrange@redhat.com>

Date: Tue, 18 Feb 2014 15:45:41 -0700

Subject: [PATCH] CVE-2013-6456: Avoid unsafe use of /proc/$PID/root in LXC USB

 hotplug

Rewrite lxcDomainAttachDeviceHostdevSubsysUSBLive function

to use the virProcessRunInMountNamespace helper. This avoids

risk of a malicious guest replacing /dev with a absolute

symlink, tricking the driver into changing the host OS

filesystem.

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>

(cherry picked from commit 7fba01c15c1f886b4235825692b4c13e88dd9f7b)

Signed-off-by: Jiri Denemark <jdenemar@redhat.com>

---

 src/lxc/lxc_driver.c | 73 ++++++++++++++++------------------------------------

 1 file changed, 22 insertions(+), 51 deletions(-)

diff --git a/src/lxc/lxc_driver.c b/src/lxc/lxc_driver.c

index e38f037..a15b67a 100644

--- a/src/lxc/lxc_driver.c

+++ b/src/lxc/lxc_driver.c

@@ -3120,6 +3120,13 @@ lxcDomainAttachDeviceMknodHelper(pid_t pid ATTRIBUTE_UNUSED,

         def->src = tmpsrc;

     }   break;

+    case VIR_DOMAIN_DEVICE_HOSTDEV: {

+        virDomainHostdevDefPtr def = data->def->data.hostdev;

+        if (virSecurityManagerSetHostdevLabel(data->driver->securityManager,

+                                              data->vm->def, def, NULL) < 0)

+            goto cleanup;

+    }   break;

+

     default:

         virReportError(VIR_ERR_INTERNAL_ERROR,

                        _("Unexpected device type %d"),

@@ -3414,13 +3421,8 @@ lxcDomainAttachDeviceHostdevSubsysUSBLive(virLXCDriverPtr driver,

     virLXCDomainObjPrivatePtr priv = vm->privateData;

     virDomainHostdevDefPtr def = dev->data.hostdev;

     int ret = -1;

-    char *vroot = NULL;

     char *src = NULL;

-    char *dstdir = NULL;

-    char *dstfile = NULL;

     struct stat sb;

-    mode_t mode;

-    bool created = false;

     virUSBDevicePtr usb = NULL;

     if (virDomainHostdevFind(vm->def, def, NULL) >= 0) {

@@ -3429,27 +3431,13 @@ lxcDomainAttachDeviceHostdevSubsysUSBLive(virLXCDriverPtr driver,

         return -1;

     }

-    if (virAsprintf(&vroot, "/proc/%llu/root",

-                    (unsigned long long)priv->initpid) < 0)

-        goto cleanup;

-

-    if (virAsprintf(&dstdir, "%s/dev/bus/usb/%03d",

-                    vroot,

-                    def->source.subsys.u.usb.bus) < 0)

-        goto cleanup;

-

-    if (virAsprintf(&dstfile, "%s/%03d",

-                    dstdir,

-                    def->source.subsys.u.usb.device) < 0)

-        goto cleanup;

-

     if (virAsprintf(&src, "/dev/bus/usb/%03d/%03d",

                     def->source.subsys.u.usb.bus,

                     def->source.subsys.u.usb.device) < 0)

         goto cleanup;

     if (!(usb = virUSBDeviceNew(def->source.subsys.u.usb.bus,

-                                def->source.subsys.u.usb.device, vroot)))

+                                def->source.subsys.u.usb.device, NULL)))

         goto cleanup;

     if (stat(src, &sb) < 0) {

@@ -3465,53 +3453,36 @@ lxcDomainAttachDeviceHostdevSubsysUSBLive(virLXCDriverPtr driver,

         goto cleanup;

     }

-    mode = 0700 | S_IFCHR;

-

     if (VIR_REALLOC_N(vm->def->hostdevs, vm->def->nhostdevs + 1) < 0)

         goto cleanup;

-    if (virFileMakePath(dstdir) < 0) {

-        virReportSystemError(errno,

-                             _("Unable to create %s"), dstdir);

-        goto cleanup;

-    }

-

-    VIR_DEBUG("Creating dev %s (%d,%d)",

-              dstfile, major(sb.st_rdev), minor(sb.st_rdev));

-    if (mknod(dstfile, mode, sb.st_rdev) < 0) {

-        virReportSystemError(errno,

-                             _("Unable to create device %s"),

-                             dstfile);

-        goto cleanup;

-    }

-    created = true;

-

-    if (lxcContainerChown(vm->def, dstfile) < 0)

-        goto cleanup;

-

-    if (virSecurityManagerSetHostdevLabel(driver->securityManager,

-                                          vm->def, def, vroot) < 0)

-        goto cleanup;

-

     if (virUSBDeviceFileIterate(usb,

                                 virLXCSetupHostUsbDeviceCgroup,

                                 priv->cgroup) < 0)

         goto cleanup;

+    if (lxcDomainAttachDeviceMknod(driver,

+                                   0700 | S_IFCHR,

+                                   sb.st_rdev,

+                                   vm,

+                                   dev,

+                                   src) < 0) {

+        if (virUSBDeviceFileIterate(usb,

+                                    virLXCTeardownHostUsbDeviceCgroup,

+                                    priv->cgroup) < 0)

+            VIR_WARN("cannot deny device %s for domain %s",

+                     src, vm->def->name);

+        goto cleanup;

+    }

+

     vm->def->hostdevs[vm->def->nhostdevs++] = def;

     ret = 0;

 cleanup:

     virDomainAuditHostdev(vm, def, "attach", ret == 0);

-    if (ret < 0 && created)

-        unlink(dstfile);

-

     virUSBDeviceFree(usb);

     VIR_FREE(src);

-    VIR_FREE(dstfile);

-    VIR_FREE(dstdir);

-    VIR_FREE(vroot);

     return ret;

 }

-- 

1.9.0