render / rpms / libvirt

Forked from rpms/libvirt 10 months ago
Clone
79b470
From 48f74599ffc86aa632ee39aff1aa8459880ec283 Mon Sep 17 00:00:00 2001
79b470
Message-Id: <48f74599ffc86aa632ee39aff1aa8459880ec283@dist-git>
79b470
From: =?UTF-8?q?J=C3=A1n=20Tomko?= <jtomko@redhat.com>
79b470
Date: Tue, 29 Sep 2020 14:43:05 +0200
79b470
Subject: [PATCH] rpc: require write acl for guest agent in
79b470
 virDomainInterfaceAddresses
79b470
MIME-Version: 1.0
79b470
Content-Type: text/plain; charset=UTF-8
79b470
Content-Transfer-Encoding: 8bit
79b470
79b470
CVE-2020-25637
79b470
79b470
Add a requirement for domain:write if source is set to
79b470
VIR_DOMAIN_INTERFACE_ADDRESSES_SRC_AGENT.
79b470
79b470
Signed-off-by: Ján Tomko <jtomko@redhat.com>
79b470
Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
79b470
(cherry picked from commit e4116eaa44cb366b59f7fe98f4b88d04c04970ad)
79b470
Signed-off-by: Ján Tomko <jtomko@redhat.com>
79b470
79b470
Conflicts: src/lxc/lxc_driver.c
79b470
    The LXC implementation of the API was introduced
79b470
    in libvirt 6.1.0, so it's not present downstream.
79b470
Message-Id: <5fdc2ebf7621698c8136b354922c687fc09286de.1601383236.git.jtomko@redhat.com>
79b470
Reviewed-by: Jiri Denemark <jdenemar@redhat.com>
79b470
---
79b470
 src/libxl/libxl_driver.c     | 2 +-
79b470
 src/qemu/qemu_driver.c       | 2 +-
79b470
 src/remote/remote_protocol.x | 1 +
79b470
 3 files changed, 3 insertions(+), 2 deletions(-)
79b470
79b470
diff --git a/src/libxl/libxl_driver.c b/src/libxl/libxl_driver.c
79b470
index f021ec9c5d..1449795494 100644
79b470
--- a/src/libxl/libxl_driver.c
79b470
+++ b/src/libxl/libxl_driver.c
79b470
@@ -6318,7 +6318,7 @@ libxlDomainInterfaceAddresses(virDomainPtr dom,
79b470
     if (!(vm = libxlDomObjFromDomain(dom)))
79b470
         goto cleanup;
79b470
 
79b470
-    if (virDomainInterfaceAddressesEnsureACL(dom->conn, vm->def) < 0)
79b470
+    if (virDomainInterfaceAddressesEnsureACL(dom->conn, vm->def, source) < 0)
79b470
         goto cleanup;
79b470
 
79b470
     if (virDomainObjCheckActive(vm) < 0)
79b470
diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c
79b470
index f8a259e020..0f06974a1b 100644
79b470
--- a/src/qemu/qemu_driver.c
79b470
+++ b/src/qemu/qemu_driver.c
79b470
@@ -22240,7 +22240,7 @@ qemuDomainInterfaceAddresses(virDomainPtr dom,
79b470
     if (!(vm = qemuDomainObjFromDomain(dom)))
79b470
         goto cleanup;
79b470
 
79b470
-    if (virDomainInterfaceAddressesEnsureACL(dom->conn, vm->def) < 0)
79b470
+    if (virDomainInterfaceAddressesEnsureACL(dom->conn, vm->def, source) < 0)
79b470
         goto cleanup;
79b470
 
79b470
     if (virDomainObjCheckActive(vm) < 0)
79b470
diff --git a/src/remote/remote_protocol.x b/src/remote/remote_protocol.x
79b470
index 2527a78142..fbd30085b2 100644
79b470
--- a/src/remote/remote_protocol.x
79b470
+++ b/src/remote/remote_protocol.x
79b470
@@ -6211,6 +6211,7 @@ enum remote_procedure {
79b470
     /**
79b470
      * @generate: none
79b470
      * @acl: domain:read
79b470
+     * @acl: domain:write::source:VIR_DOMAIN_INTERFACE_ADDRESSES_SRC_AGENT
79b470
      */
79b470
     REMOTE_PROC_DOMAIN_INTERFACE_ADDRESSES = 353,
79b470
 
79b470
-- 
79b470
2.28.0
79b470