valeriyvdovin / rpms / systemd

Forked from rpms/systemd 4 years ago
Clone

Blame SOURCES/0552-journald-never-accept-fds-from-file-systems-with-man.patch

dd65c9
From 6d9aff83ef5d50a65fad4f4218073bd4aa3e6902 Mon Sep 17 00:00:00 2001
dd65c9
From: Lennart Poettering <lennart@poettering.net>
dd65c9
Date: Tue, 10 Nov 2015 20:08:04 +0100
dd65c9
Subject: [PATCH] journald: never accept fds from file systems with mandatory
dd65c9
 locking enabled
dd65c9
dd65c9
This is pretty much a work-around for a security vulnerability in
dd65c9
kernels that allow unprivileged user namespaces.
dd65c9
dd65c9
Fixes #1822.
dd65c9
dd65c9
Cherry-picked from: 1e603a482f57edb1fb863dbf23b868cf5854e004
dd65c9
Resolves: #1501017
dd65c9
---
dd65c9
 src/journal/journald-native.c | 30 ++++++++++++++++++++++++++++++
dd65c9
 1 file changed, 30 insertions(+)
dd65c9
dd65c9
diff --git a/src/journal/journald-native.c b/src/journal/journald-native.c
c62b8e
index 2c9cf6e7a8..fdb1a38ddc 100644
dd65c9
--- a/src/journal/journald-native.c
dd65c9
+++ b/src/journal/journald-native.c
dd65c9
@@ -23,6 +23,7 @@
dd65c9
 #include <stddef.h>
dd65c9
 #include <sys/epoll.h>
dd65c9
 #include <sys/mman.h>
dd65c9
+#include <sys/statvfs.h>
dd65c9
 
dd65c9
 #include "socket-util.h"
dd65c9
 #include "path-util.h"
dd65c9
@@ -391,8 +392,37 @@ void server_process_native_file(
dd65c9
                 assert_se(munmap(p, ps) >= 0);
dd65c9
         } else {
dd65c9
                 _cleanup_free_ void *p = NULL;
dd65c9
+                struct statvfs vfs;
dd65c9
                 ssize_t n;
dd65c9
 
dd65c9
+                if (fstatvfs(fd, &vfs) < 0) {
dd65c9
+                        log_error_errno(errno, "Failed to stat file system of passed file, ignoring: %m");
dd65c9
+                        return;
dd65c9
+                }
dd65c9
+
dd65c9
+                /* Refuse operating on file systems that have
dd65c9
+                 * mandatory locking enabled, see:
dd65c9
+                 *
dd65c9
+                 * https://github.com/systemd/systemd/issues/1822
dd65c9
+                 */
dd65c9
+                if (vfs.f_flag & ST_MANDLOCK) {
dd65c9
+                        log_error("Received file descriptor from file system with mandatory locking enable, refusing.");
dd65c9
+                        return;
dd65c9
+                }
dd65c9
+
dd65c9
+                /* Make the fd non-blocking. On regular files this has
dd65c9
+                 * the effect of bypassing mandatory locking. Of
dd65c9
+                 * course, this should normally not be necessary given
dd65c9
+                 * the check above, but let's better be safe than
dd65c9
+                 * sorry, after all NFS is pretty confusing regarding
dd65c9
+                 * file system flags, and we better don't trust it,
dd65c9
+                 * and so is SMB. */
dd65c9
+                r = fd_nonblock(fd, true);
dd65c9
+                if (r < 0) {
dd65c9
+                        log_error_errno(r, "Failed to make fd non-blocking, ignoring: %m");
dd65c9
+                        return;
dd65c9
+                }
dd65c9
+
dd65c9
                 /* The file is not sealed, we can't map the file here, since
dd65c9
                  * clients might then truncate it and trigger a SIGBUS for
dd65c9
                  * us. So let's stupidly read it */