|
 |
887953 |
From 3d81f70f181793c6b1fd6b53523158fd663b8c74 Mon Sep 17 00:00:00 2001
|
|
|
887953 |
From: Amar Tumballi <amarts@redhat.com>
|
|
|
887953 |
Date: Wed, 5 Sep 2018 19:03:08 +0530
|
|
|
887953 |
Subject: [PATCH 373/385] posix: disable open/read/write on special files
|
|
|
887953 |
|
|
|
887953 |
In the file system, the responsibility w.r.to the block and char device
|
|
|
887953 |
files is related to only support for 'creating' them (using mknod(2)).
|
|
|
887953 |
|
|
|
887953 |
Once the device files are created, the read/write syscalls for the specific
|
|
|
887953 |
devices are handled by the device driver registered for the specific major
|
|
|
887953 |
number, and depending on the minor number, it knows where to read from.
|
|
|
887953 |
Hence, we are at risk of reading contents from devices which are handled
|
|
|
887953 |
by the host kernel on server nodes.
|
|
|
887953 |
|
|
|
887953 |
By disabling open/read/write on the device file, we would be safe with
|
|
|
887953 |
the bypass one can achieve from client side (using gfapi)
|
|
|
887953 |
|
|
|
887953 |
Upstream Fix
|
|
|
887953 |
Upstream Patch: https://review.gluster.org/#/c/glusterfs/+/21069/
|
|
|
887953 |
> Change-Id: I48c776b0af1cbd2a5240862826d3d8918601e47f
|
|
|
887953 |
> BUG: 1625648
|
|
|
887953 |
|
|
|
887953 |
BUG: 1622649
|
|
|
887953 |
|
|
|
887953 |
Change-Id: I1135e89270fac05ccfb8a3faa9fdffb58eb51b15
|
|
|
887953 |
Signed-off-by: Amar Tumballi <amarts@redhat.com>
|
|
|
887953 |
Reviewed-on: https://code.engineering.redhat.com/gerrit/149667
|
|
|
887953 |
Tested-by: RHGS Build Bot <nigelb@redhat.com>
|
|
|
887953 |
Reviewed-by: Sunil Kumar Heggodu Gopala Acharya <sheggodu@redhat.com>
|
|
|
887953 |
---
|
|
|
887953 |
xlators/storage/posix/src/posix.c | 34 ++++++++++++++++++++++++++++++++++
|
|
|
887953 |
1 file changed, 34 insertions(+)
|
|
|
887953 |
|
|
|
887953 |
diff --git a/xlators/storage/posix/src/posix.c b/xlators/storage/posix/src/posix.c
|
|
|
887953 |
index e0165f8..efbf804 100644
|
|
|
887953 |
--- a/xlators/storage/posix/src/posix.c
|
|
|
887953 |
+++ b/xlators/storage/posix/src/posix.c
|
|
|
887953 |
@@ -3336,6 +3336,17 @@ posix_open (call_frame_t *frame, xlator_t *this,
|
|
|
887953 |
priv = this->private;
|
|
|
887953 |
VALIDATE_OR_GOTO (priv, out);
|
|
|
887953 |
|
|
|
887953 |
+ if (loc->inode &&
|
|
|
887953 |
+ ((loc->inode->ia_type == IA_IFBLK) ||
|
|
|
887953 |
+ (loc->inode->ia_type == IA_IFCHR))) {
|
|
|
887953 |
+ gf_msg (this->name, GF_LOG_ERROR, EINVAL,
|
|
|
887953 |
+ P_MSG_INVALID_ARGUMENT,
|
|
|
887953 |
+ "open received on a block/char file (%s)",
|
|
|
887953 |
+ uuid_utoa (loc->inode->gfid));
|
|
|
887953 |
+ op_errno = EINVAL;
|
|
|
887953 |
+ goto out;
|
|
|
887953 |
+ }
|
|
|
887953 |
+
|
|
|
887953 |
if (flags & O_CREAT)
|
|
|
887953 |
DISK_SPACE_CHECK_AND_GOTO (frame, priv, xdata, op_ret, op_errno, out);
|
|
|
887953 |
|
|
|
887953 |
@@ -3428,6 +3439,17 @@ posix_readv (call_frame_t *frame, xlator_t *this,
|
|
|
887953 |
priv = this->private;
|
|
|
887953 |
VALIDATE_OR_GOTO (priv, out);
|
|
|
887953 |
|
|
|
887953 |
+ if (fd->inode &&
|
|
|
887953 |
+ ((fd->inode->ia_type == IA_IFBLK) ||
|
|
|
887953 |
+ (fd->inode->ia_type == IA_IFCHR))) {
|
|
|
887953 |
+ gf_msg (this->name, GF_LOG_ERROR, EINVAL,
|
|
|
887953 |
+ P_MSG_INVALID_ARGUMENT,
|
|
|
887953 |
+ "readv received on a block/char file (%s)",
|
|
|
887953 |
+ uuid_utoa (fd->inode->gfid));
|
|
|
887953 |
+ op_errno = EINVAL;
|
|
|
887953 |
+ goto out;
|
|
|
887953 |
+ }
|
|
|
887953 |
+
|
|
|
887953 |
ret = posix_fd_ctx_get (fd, this, &pfd, &op_errno);
|
|
|
887953 |
if (ret < 0) {
|
|
|
887953 |
gf_msg (this->name, GF_LOG_WARNING, op_errno, P_MSG_PFD_NULL,
|
|
|
887953 |
@@ -3674,6 +3696,18 @@ posix_writev (call_frame_t *frame, xlator_t *this, fd_t *fd,
|
|
|
887953 |
priv = this->private;
|
|
|
887953 |
|
|
|
887953 |
VALIDATE_OR_GOTO (priv, out);
|
|
|
887953 |
+
|
|
|
887953 |
+ if (fd->inode &&
|
|
|
887953 |
+ ((fd->inode->ia_type == IA_IFBLK) ||
|
|
|
887953 |
+ (fd->inode->ia_type == IA_IFCHR))) {
|
|
|
887953 |
+ gf_msg (this->name, GF_LOG_ERROR, EINVAL,
|
|
|
887953 |
+ P_MSG_INVALID_ARGUMENT,
|
|
|
887953 |
+ "writev received on a block/char file (%s)",
|
|
|
887953 |
+ uuid_utoa (fd->inode->gfid));
|
|
|
887953 |
+ op_errno = EINVAL;
|
|
|
887953 |
+ goto out;
|
|
|
887953 |
+ }
|
|
|
887953 |
+
|
|
|
887953 |
DISK_SPACE_CHECK_AND_GOTO (frame, priv, xdata, op_ret, op_errno, out);
|
|
|
887953 |
|
|
|
887953 |
ret = posix_fd_ctx_get (fd, this, &pfd, &op_errno);
|
|
|
887953 |
--
|
|
|
887953 |
1.8.3.1
|
|
|
887953 |
|