|
 |
47585c |
From e313bd648a4c8a9526421e270eb597a5de1e0c7f Mon Sep 17 00:00:00 2001
|
|
|
47585c |
From: Lee Duncan <lduncan@suse.com>
|
|
|
47585c |
Date: Fri, 15 Dec 2017 10:36:11 -0800
|
|
|
47585c |
Subject: [PATCH] Check for root peer user for iscsiuio IPC
|
|
|
47585c |
|
|
|
47585c |
This fixes a possible vulnerability where a non-root
|
|
|
47585c |
process could connect with iscsiuio. Fouund by Qualsys.
|
|
|
47585c |
---
|
|
|
47585c |
iscsiuio/src/unix/Makefile.am | 3 ++-
|
|
|
47585c |
iscsiuio/src/unix/iscsid_ipc.c | 47 ++++++++++++++++++++++++++++++++++
|
|
|
47585c |
2 files changed, 49 insertions(+), 1 deletion(-)
|
|
|
47585c |
|
|
|
47585c |
diff --git a/iscsiuio/src/unix/Makefile.am b/iscsiuio/src/unix/Makefile.am
|
|
|
47585c |
index 71d54633a764..a989ef029b59 100644
|
|
|
47585c |
--- a/iscsiuio/src/unix/Makefile.am
|
|
|
47585c |
+++ b/iscsiuio/src/unix/Makefile.am
|
|
|
47585c |
@@ -20,7 +20,8 @@ iscsiuio_SOURCES = build_date.c \
|
|
|
47585c |
nic_utils.c \
|
|
|
47585c |
packet.c \
|
|
|
47585c |
iscsid_ipc.c \
|
|
|
47585c |
- ping.c
|
|
|
47585c |
+ ping.c \
|
|
|
47585c |
+ ${top_srcdir}/../utils/sysdeps/sysdeps.c
|
|
|
47585c |
|
|
|
47585c |
iscsiuio_CFLAGS = $(AM_CFLAGS) \
|
|
|
47585c |
$(LIBNL_CFLAGS) \
|
|
|
47585c |
diff --git a/iscsiuio/src/unix/iscsid_ipc.c b/iscsiuio/src/unix/iscsid_ipc.c
|
|
|
47585c |
index 658362899234..64762654c523 100644
|
|
|
47585c |
--- a/iscsiuio/src/unix/iscsid_ipc.c
|
|
|
47585c |
+++ b/iscsiuio/src/unix/iscsid_ipc.c
|
|
|
47585c |
@@ -37,6 +37,8 @@
|
|
|
47585c |
*
|
|
|
47585c |
*/
|
|
|
47585c |
|
|
|
47585c |
+#define _GNU_SOURCE
|
|
|
47585c |
+
|
|
|
47585c |
#include <errno.h>
|
|
|
47585c |
#include <pthread.h>
|
|
|
47585c |
#include <signal.h>
|
|
|
47585c |
@@ -47,6 +49,8 @@
|
|
|
47585c |
#include <sys/socket.h>
|
|
|
47585c |
#include <sys/time.h>
|
|
|
47585c |
#include <sys/un.h>
|
|
|
47585c |
+#include <sys/types.h>
|
|
|
47585c |
+#include <pwd.h>
|
|
|
47585c |
|
|
|
47585c |
#define PFX "iscsi_ipc "
|
|
|
47585c |
|
|
|
47585c |
@@ -61,6 +65,7 @@
|
|
|
47585c |
#include "iscsid_ipc.h"
|
|
|
47585c |
#include "uip.h"
|
|
|
47585c |
#include "uip_mgmt_ipc.h"
|
|
|
47585c |
+#include "sysdeps.h"
|
|
|
47585c |
|
|
|
47585c |
#include "logger.h"
|
|
|
47585c |
#include "uip.h"
|
|
|
47585c |
@@ -102,6 +107,7 @@ struct iface_rec_decode {
|
|
|
47585c |
uint16_t mtu;
|
|
|
47585c |
};
|
|
|
47585c |
|
|
|
47585c |
+#define PEERUSER_MAX 64
|
|
|
47585c |
|
|
|
47585c |
/******************************************************************************
|
|
|
47585c |
* Globals
|
|
|
47585c |
@@ -1024,6 +1030,40 @@ static void iscsid_loop_close(void *arg)
|
|
|
47585c |
LOG_INFO(PFX "iSCSI daemon socket closed");
|
|
|
47585c |
}
|
|
|
47585c |
|
|
|
47585c |
+/*
|
|
|
47585c |
+ * check that the peer user is privilidged
|
|
|
47585c |
+ *
|
|
|
47585c |
+ * return 1 if peer is ok else 0
|
|
|
47585c |
+ *
|
|
|
47585c |
+ * XXX: this function is copied from iscsid_ipc.c and should be
|
|
|
47585c |
+ * moved into a common library
|
|
|
47585c |
+ */
|
|
|
47585c |
+static int
|
|
|
47585c |
+mgmt_peeruser(int sock, char *user)
|
|
|
47585c |
+{
|
|
|
47585c |
+ struct ucred peercred;
|
|
|
47585c |
+ socklen_t so_len = sizeof(peercred);
|
|
|
47585c |
+ struct passwd *pass;
|
|
|
47585c |
+
|
|
|
47585c |
+ errno = 0;
|
|
|
47585c |
+ if (getsockopt(sock, SOL_SOCKET, SO_PEERCRED, &peercred,
|
|
|
47585c |
+ &so_len) != 0 || so_len != sizeof(peercred)) {
|
|
|
47585c |
+ /* We didn't get a valid credentials struct. */
|
|
|
47585c |
+ LOG_ERR(PFX "peeruser_unux: error receiving credentials: %m");
|
|
|
47585c |
+ return 0;
|
|
|
47585c |
+ }
|
|
|
47585c |
+
|
|
|
47585c |
+ pass = getpwuid(peercred.uid);
|
|
|
47585c |
+ if (pass == NULL) {
|
|
|
47585c |
+ LOG_ERR(PFX "peeruser_unix: unknown local user with uid %d",
|
|
|
47585c |
+ (int) peercred.uid);
|
|
|
47585c |
+ return 0;
|
|
|
47585c |
+ }
|
|
|
47585c |
+
|
|
|
47585c |
+ strlcpy(user, pass->pw_name, PEERUSER_MAX);
|
|
|
47585c |
+ return 1;
|
|
|
47585c |
+}
|
|
|
47585c |
+
|
|
|
47585c |
/**
|
|
|
47585c |
* iscsid_loop() - This is the function which will process the broadcast
|
|
|
47585c |
* messages from iscsid
|
|
|
47585c |
@@ -1033,6 +1073,7 @@ static void *iscsid_loop(void *arg)
|
|
|
47585c |
{
|
|
|
47585c |
int rc;
|
|
|
47585c |
sigset_t set;
|
|
|
47585c |
+ char user[PEERUSER_MAX];
|
|
|
47585c |
|
|
|
47585c |
pthread_cleanup_push(iscsid_loop_close, arg);
|
|
|
47585c |
|
|
|
47585c |
@@ -1072,6 +1113,12 @@ static void *iscsid_loop(void *arg)
|
|
|
47585c |
continue;
|
|
|
47585c |
}
|
|
|
47585c |
|
|
|
47585c |
+ if (!mgmt_peeruser(iscsid_opts.fd, user) || strncmp(user, "root", PEERUSER_MAX)) {
|
|
|
47585c |
+ close(s2);
|
|
|
47585c |
+ LOG_ERR(PFX "Access error: non-administrative connection rejected");
|
|
|
47585c |
+ break;
|
|
|
47585c |
+ }
|
|
|
47585c |
+
|
|
|
47585c |
process_iscsid_broadcast(s2);
|
|
|
47585c |
close(s2);
|
|
|
47585c |
}
|
|
|
47585c |
--
|
|
|
47585c |
2.17.2
|
|
|
47585c |
|