|
 |
c401cc |
From 412bf59db246bcbf4f07294ec6a0f8540032307c Mon Sep 17 00:00:00 2001
|
|
|
c401cc |
Message-Id: <412bf59db246bcbf4f07294ec6a0f8540032307c@dist-git>
|
|
|
c401cc |
From: "Daniel P. Berrange" <berrange@redhat.com>
|
|
|
c401cc |
Date: Tue, 18 Feb 2014 15:45:42 -0700
|
|
|
c401cc |
Subject: [PATCH] CVE-2013-6456: Avoid unsafe use of /proc/$PID/root in LXC
|
|
|
c401cc |
block hostdev hotplug
|
|
|
c401cc |
|
|
|
c401cc |
Rewrite lxcDomainAttachDeviceHostdevStorageLive function
|
|
|
c401cc |
to use the virProcessRunInMountNamespace helper. This avoids
|
|
|
c401cc |
risk of a malicious guest replacing /dev with a absolute
|
|
|
c401cc |
symlink, tricking the driver into changing the host OS
|
|
|
c401cc |
filesystem.
|
|
|
c401cc |
|
|
|
c401cc |
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
|
|
|
c401cc |
(cherry picked from commit 1754c7f0ab1407dcf7c89636a35711dd9b1febe1)
|
|
|
c401cc |
Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
|
|
|
c401cc |
---
|
|
|
c401cc |
src/lxc/lxc_driver.c | 66 ++++++++++++++--------------------------------------
|
|
|
c401cc |
1 file changed, 18 insertions(+), 48 deletions(-)
|
|
|
c401cc |
|
|
|
c401cc |
diff --git a/src/lxc/lxc_driver.c b/src/lxc/lxc_driver.c
|
|
|
c401cc |
index a15b67a..3920ad9 100644
|
|
|
c401cc |
--- a/src/lxc/lxc_driver.c
|
|
|
c401cc |
+++ b/src/lxc/lxc_driver.c
|
|
|
c401cc |
@@ -3495,11 +3495,7 @@ lxcDomainAttachDeviceHostdevStorageLive(virLXCDriverPtr driver,
|
|
|
c401cc |
virLXCDomainObjPrivatePtr priv = vm->privateData;
|
|
|
c401cc |
virDomainHostdevDefPtr def = dev->data.hostdev;
|
|
|
c401cc |
int ret = -1;
|
|
|
c401cc |
- char *dst = NULL;
|
|
|
c401cc |
- char *vroot = NULL;
|
|
|
c401cc |
struct stat sb;
|
|
|
c401cc |
- bool created = false;
|
|
|
c401cc |
- mode_t mode = 0;
|
|
|
c401cc |
|
|
|
c401cc |
if (!def->source.caps.u.storage.block) {
|
|
|
c401cc |
virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
|
|
|
c401cc |
@@ -3527,51 +3523,29 @@ lxcDomainAttachDeviceHostdevStorageLive(virLXCDriverPtr driver,
|
|
|
c401cc |
goto cleanup;
|
|
|
c401cc |
}
|
|
|
c401cc |
|
|
|
c401cc |
- if (virAsprintf(&vroot, "/proc/%llu/root",
|
|
|
c401cc |
- (unsigned long long)priv->initpid) < 0)
|
|
|
c401cc |
- goto cleanup;
|
|
|
c401cc |
-
|
|
|
c401cc |
- if (virAsprintf(&dst, "%s/%s",
|
|
|
c401cc |
- vroot,
|
|
|
c401cc |
- def->source.caps.u.storage.block) < 0)
|
|
|
c401cc |
- goto cleanup;
|
|
|
c401cc |
-
|
|
|
c401cc |
if (VIR_REALLOC_N(vm->def->hostdevs, vm->def->nhostdevs+1) < 0)
|
|
|
c401cc |
goto cleanup;
|
|
|
c401cc |
|
|
|
c401cc |
- if (lxcContainerSetupHostdevCapsMakePath(dst) < 0) {
|
|
|
c401cc |
- virReportSystemError(errno,
|
|
|
c401cc |
- _("Unable to create directory for device %s"),
|
|
|
c401cc |
- dst);
|
|
|
c401cc |
- goto cleanup;
|
|
|
c401cc |
- }
|
|
|
c401cc |
-
|
|
|
c401cc |
- mode = 0700 | S_IFBLK;
|
|
|
c401cc |
-
|
|
|
c401cc |
- VIR_DEBUG("Creating dev %s (%d,%d)",
|
|
|
c401cc |
- def->source.caps.u.storage.block,
|
|
|
c401cc |
- major(sb.st_rdev), minor(sb.st_rdev));
|
|
|
c401cc |
- if (mknod(dst, mode, sb.st_rdev) < 0) {
|
|
|
c401cc |
- virReportSystemError(errno,
|
|
|
c401cc |
- _("Unable to create device %s"),
|
|
|
c401cc |
- dst);
|
|
|
c401cc |
- goto cleanup;
|
|
|
c401cc |
- }
|
|
|
c401cc |
- created = true;
|
|
|
c401cc |
-
|
|
|
c401cc |
- if (lxcContainerChown(vm->def, dst) < 0)
|
|
|
c401cc |
- goto cleanup;
|
|
|
c401cc |
-
|
|
|
c401cc |
- if (virSecurityManagerSetHostdevLabel(driver->securityManager,
|
|
|
c401cc |
- vm->def, def, vroot) < 0)
|
|
|
c401cc |
+ if (virCgroupAllowDevice(priv->cgroup,
|
|
|
c401cc |
+ 'b',
|
|
|
c401cc |
+ major(sb.st_rdev),
|
|
|
c401cc |
+ minor(sb.st_rdev),
|
|
|
c401cc |
+ VIR_CGROUP_DEVICE_RWM) < 0)
|
|
|
c401cc |
goto cleanup;
|
|
|
c401cc |
|
|
|
c401cc |
- if (virCgroupAllowDevicePath(priv->cgroup, def->source.caps.u.storage.block,
|
|
|
c401cc |
- VIR_CGROUP_DEVICE_RW |
|
|
|
c401cc |
- VIR_CGROUP_DEVICE_MKNOD) != 0) {
|
|
|
c401cc |
- virReportError(VIR_ERR_INTERNAL_ERROR,
|
|
|
c401cc |
- _("cannot allow device %s for domain %s"),
|
|
|
c401cc |
- def->source.caps.u.storage.block, vm->def->name);
|
|
|
c401cc |
+ if (lxcDomainAttachDeviceMknod(driver,
|
|
|
c401cc |
+ 0700 | S_IFBLK,
|
|
|
c401cc |
+ sb.st_rdev,
|
|
|
c401cc |
+ vm,
|
|
|
c401cc |
+ dev,
|
|
|
c401cc |
+ def->source.caps.u.storage.block) < 0) {
|
|
|
c401cc |
+ if (virCgroupDenyDevice(priv->cgroup,
|
|
|
c401cc |
+ 'b',
|
|
|
c401cc |
+ major(sb.st_rdev),
|
|
|
c401cc |
+ minor(sb.st_rdev),
|
|
|
c401cc |
+ VIR_CGROUP_DEVICE_RWM) < 0)
|
|
|
c401cc |
+ VIR_WARN("cannot deny device %s for domain %s",
|
|
|
c401cc |
+ def->source.caps.u.storage.block, vm->def->name);
|
|
|
c401cc |
goto cleanup;
|
|
|
c401cc |
}
|
|
|
c401cc |
|
|
|
c401cc |
@@ -3581,10 +3555,6 @@ lxcDomainAttachDeviceHostdevStorageLive(virLXCDriverPtr driver,
|
|
|
c401cc |
|
|
|
c401cc |
cleanup:
|
|
|
c401cc |
virDomainAuditHostdev(vm, def, "attach", ret == 0);
|
|
|
c401cc |
- if (dst && created && ret < 0)
|
|
|
c401cc |
- unlink(dst);
|
|
|
c401cc |
- VIR_FREE(dst);
|
|
|
c401cc |
- VIR_FREE(vroot);
|
|
|
c401cc |
return ret;
|
|
|
c401cc |
}
|
|
|
c401cc |
|
|
|
c401cc |
--
|
|
|
c401cc |
1.9.0
|
|
|
c401cc |
|