|
 |
923a60 |
From 6d9aff83ef5d50a65fad4f4218073bd4aa3e6902 Mon Sep 17 00:00:00 2001
|
|
|
923a60 |
From: Lennart Poettering <lennart@poettering.net>
|
|
|
923a60 |
Date: Tue, 10 Nov 2015 20:08:04 +0100
|
|
|
923a60 |
Subject: [PATCH] journald: never accept fds from file systems with mandatory
|
|
|
923a60 |
locking enabled
|
|
|
923a60 |
|
|
|
923a60 |
This is pretty much a work-around for a security vulnerability in
|
|
|
923a60 |
kernels that allow unprivileged user namespaces.
|
|
|
923a60 |
|
|
|
923a60 |
Fixes #1822.
|
|
|
923a60 |
|
|
|
923a60 |
Cherry-picked from: 1e603a482f57edb1fb863dbf23b868cf5854e004
|
|
|
923a60 |
Resolves: #1501017
|
|
|
923a60 |
---
|
|
|
923a60 |
src/journal/journald-native.c | 30 ++++++++++++++++++++++++++++++
|
|
|
923a60 |
1 file changed, 30 insertions(+)
|
|
|
923a60 |
|
|
|
923a60 |
diff --git a/src/journal/journald-native.c b/src/journal/journald-native.c
|
|
|
923a60 |
index 2c9cf6e7a8..fdb1a38ddc 100644
|
|
|
923a60 |
--- a/src/journal/journald-native.c
|
|
|
923a60 |
+++ b/src/journal/journald-native.c
|
|
|
923a60 |
@@ -23,6 +23,7 @@
|
|
|
923a60 |
#include <stddef.h>
|
|
|
923a60 |
#include <sys/epoll.h>
|
|
|
923a60 |
#include <sys/mman.h>
|
|
|
923a60 |
+#include <sys/statvfs.h>
|
|
|
923a60 |
|
|
|
923a60 |
#include "socket-util.h"
|
|
|
923a60 |
#include "path-util.h"
|
|
|
923a60 |
@@ -391,8 +392,37 @@ void server_process_native_file(
|
|
|
923a60 |
assert_se(munmap(p, ps) >= 0);
|
|
|
923a60 |
} else {
|
|
|
923a60 |
_cleanup_free_ void *p = NULL;
|
|
|
923a60 |
+ struct statvfs vfs;
|
|
|
923a60 |
ssize_t n;
|
|
|
923a60 |
|
|
|
923a60 |
+ if (fstatvfs(fd, &vfs) < 0) {
|
|
|
923a60 |
+ log_error_errno(errno, "Failed to stat file system of passed file, ignoring: %m");
|
|
|
923a60 |
+ return;
|
|
|
923a60 |
+ }
|
|
|
923a60 |
+
|
|
|
923a60 |
+ /* Refuse operating on file systems that have
|
|
|
923a60 |
+ * mandatory locking enabled, see:
|
|
|
923a60 |
+ *
|
|
|
923a60 |
+ * https://github.com/systemd/systemd/issues/1822
|
|
|
923a60 |
+ */
|
|
|
923a60 |
+ if (vfs.f_flag & ST_MANDLOCK) {
|
|
|
923a60 |
+ log_error("Received file descriptor from file system with mandatory locking enable, refusing.");
|
|
|
923a60 |
+ return;
|
|
|
923a60 |
+ }
|
|
|
923a60 |
+
|
|
|
923a60 |
+ /* Make the fd non-blocking. On regular files this has
|
|
|
923a60 |
+ * the effect of bypassing mandatory locking. Of
|
|
|
923a60 |
+ * course, this should normally not be necessary given
|
|
|
923a60 |
+ * the check above, but let's better be safe than
|
|
|
923a60 |
+ * sorry, after all NFS is pretty confusing regarding
|
|
|
923a60 |
+ * file system flags, and we better don't trust it,
|
|
|
923a60 |
+ * and so is SMB. */
|
|
|
923a60 |
+ r = fd_nonblock(fd, true);
|
|
|
923a60 |
+ if (r < 0) {
|
|
|
923a60 |
+ log_error_errno(r, "Failed to make fd non-blocking, ignoring: %m");
|
|
|
923a60 |
+ return;
|
|
|
923a60 |
+ }
|
|
|
923a60 |
+
|
|
|
923a60 |
/* The file is not sealed, we can't map the file here, since
|
|
|
923a60 |
* clients might then truncate it and trigger a SIGBUS for
|
|
|
923a60 |
* us. So let's stupidly read it */
|