22c213
From f62613d8058bcb60b26727d980a37537103b0033 Mon Sep 17 00:00:00 2001
22c213
From: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
22c213
Date: Mon, 27 Jan 2020 19:01:32 +0100
22c213
Subject: [PATCH 061/116] virtiofsd: cap-ng helpers
22c213
MIME-Version: 1.0
22c213
Content-Type: text/plain; charset=UTF-8
22c213
Content-Transfer-Encoding: 8bit
22c213
22c213
RH-Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
22c213
Message-id: <20200127190227.40942-58-dgilbert@redhat.com>
22c213
Patchwork-id: 93512
22c213
O-Subject: [RHEL-AV-8.2 qemu-kvm PATCH 057/112] virtiofsd: cap-ng helpers
22c213
Bugzilla: 1694164
22c213
RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
22c213
RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
22c213
RH-Acked-by: Sergio Lopez Pascual <slp@redhat.com>
22c213
22c213
From: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
22c213
22c213
libcap-ng reads /proc during capng_get_caps_process, and virtiofsd's
22c213
sandboxing doesn't have /proc mounted; thus we have to do the
22c213
caps read before we sandbox it and save/restore the state.
22c213
22c213
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
22c213
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
22c213
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
22c213
(cherry picked from commit 2405f3c0d19eb4d516a88aa4e5c54e5f9c6bbea3)
22c213
Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
22c213
---
22c213
 Makefile                         |  4 +--
22c213
 tools/virtiofsd/passthrough_ll.c | 72 ++++++++++++++++++++++++++++++++++++++++
22c213
 2 files changed, 74 insertions(+), 2 deletions(-)
22c213
22c213
diff --git a/Makefile b/Makefile
22c213
index 6879a06..ff05c30 100644
22c213
--- a/Makefile
22c213
+++ b/Makefile
22c213
@@ -330,7 +330,7 @@ endif
22c213
 endif
22c213
 endif
22c213
 
22c213
-ifeq ($(CONFIG_LINUX)$(CONFIG_SECCOMP),yy)
22c213
+ifeq ($(CONFIG_LINUX)$(CONFIG_SECCOMP)$(CONFIG_LIBCAP_NG),yyy)
22c213
 HELPERS-y += virtiofsd$(EXESUF)
22c213
 vhost-user-json-y += tools/virtiofsd/50-qemu-virtiofsd.json
22c213
 endif
22c213
@@ -682,7 +682,7 @@ rdmacm-mux$(EXESUF): $(rdmacm-mux-obj-y) $(COMMON_LDADDS)
22c213
 	$(call LINK, $^)
22c213
 
22c213
 # relies on Linux-specific syscalls
22c213
-ifeq ($(CONFIG_LINUX)$(CONFIG_SECCOMP),yy)
22c213
+ifeq ($(CONFIG_LINUX)$(CONFIG_SECCOMP)$(CONFIG_LIBCAP_NG),yyy)
22c213
 virtiofsd$(EXESUF): $(virtiofsd-obj-y) libvhost-user.a $(COMMON_LDADDS)
22c213
 	$(call LINK, $^)
22c213
 endif
22c213
diff --git a/tools/virtiofsd/passthrough_ll.c b/tools/virtiofsd/passthrough_ll.c
22c213
index bd8925b..97e7c75 100644
22c213
--- a/tools/virtiofsd/passthrough_ll.c
22c213
+++ b/tools/virtiofsd/passthrough_ll.c
22c213
@@ -39,6 +39,7 @@
22c213
 #include "fuse_virtio.h"
22c213
 #include "fuse_lowlevel.h"
22c213
 #include <assert.h>
22c213
+#include <cap-ng.h>
22c213
 #include <dirent.h>
22c213
 #include <errno.h>
22c213
 #include <inttypes.h>
22c213
@@ -139,6 +140,13 @@ static const struct fuse_opt lo_opts[] = {
22c213
 
22c213
 static void unref_inode(struct lo_data *lo, struct lo_inode *inode, uint64_t n);
22c213
 
22c213
+static struct {
22c213
+    pthread_mutex_t mutex;
22c213
+    void *saved;
22c213
+} cap;
22c213
+/* That we loaded cap-ng in the current thread from the saved */
22c213
+static __thread bool cap_loaded = 0;
22c213
+
22c213
 static struct lo_inode *lo_find(struct lo_data *lo, struct stat *st);
22c213
 
22c213
 static int is_dot_or_dotdot(const char *name)
22c213
@@ -162,6 +170,37 @@ static struct lo_data *lo_data(fuse_req_t req)
22c213
     return (struct lo_data *)fuse_req_userdata(req);
22c213
 }
22c213
 
22c213
+/*
22c213
+ * Load capng's state from our saved state if the current thread
22c213
+ * hadn't previously been loaded.
22c213
+ * returns 0 on success
22c213
+ */
22c213
+static int load_capng(void)
22c213
+{
22c213
+    if (!cap_loaded) {
22c213
+        pthread_mutex_lock(&cap.mutex);
22c213
+        capng_restore_state(&cap.saved);
22c213
+        /*
22c213
+         * restore_state free's the saved copy
22c213
+         * so make another.
22c213
+         */
22c213
+        cap.saved = capng_save_state();
22c213
+        if (!cap.saved) {
22c213
+            fuse_log(FUSE_LOG_ERR, "capng_save_state (thread)\n");
22c213
+            return -EINVAL;
22c213
+        }
22c213
+        pthread_mutex_unlock(&cap.mutex);
22c213
+
22c213
+        /*
22c213
+         * We want to use the loaded state for our pid,
22c213
+         * not the original
22c213
+         */
22c213
+        capng_setpid(syscall(SYS_gettid));
22c213
+        cap_loaded = true;
22c213
+    }
22c213
+    return 0;
22c213
+}
22c213
+
22c213
 static void lo_map_init(struct lo_map *map)
22c213
 {
22c213
     map->elems = NULL;
22c213
@@ -2024,6 +2063,35 @@ static void setup_namespaces(struct lo_data *lo, struct fuse_session *se)
22c213
 }
22c213
 
22c213
 /*
22c213
+ * Capture the capability state, we'll need to restore this for individual
22c213
+ * threads later; see load_capng.
22c213
+ */
22c213
+static void setup_capng(void)
22c213
+{
22c213
+    /* Note this accesses /proc so has to happen before the sandbox */
22c213
+    if (capng_get_caps_process()) {
22c213
+        fuse_log(FUSE_LOG_ERR, "capng_get_caps_process\n");
22c213
+        exit(1);
22c213
+    }
22c213
+    pthread_mutex_init(&cap.mutex, NULL);
22c213
+    pthread_mutex_lock(&cap.mutex);
22c213
+    cap.saved = capng_save_state();
22c213
+    if (!cap.saved) {
22c213
+        fuse_log(FUSE_LOG_ERR, "capng_save_state\n");
22c213
+        exit(1);
22c213
+    }
22c213
+    pthread_mutex_unlock(&cap.mutex);
22c213
+}
22c213
+
22c213
+static void cleanup_capng(void)
22c213
+{
22c213
+    free(cap.saved);
22c213
+    cap.saved = NULL;
22c213
+    pthread_mutex_destroy(&cap.mutex);
22c213
+}
22c213
+
22c213
+
22c213
+/*
22c213
  * Make the source directory our root so symlinks cannot escape and no other
22c213
  * files are accessible.  Assumes unshare(CLONE_NEWNS) was already called.
22c213
  */
22c213
@@ -2216,12 +2284,16 @@ int main(int argc, char *argv[])
22c213
 
22c213
     fuse_daemonize(opts.foreground);
22c213
 
22c213
+    /* Must be before sandbox since it wants /proc */
22c213
+    setup_capng();
22c213
+
22c213
     setup_sandbox(&lo, se);
22c213
 
22c213
     /* Block until ctrl+c or fusermount -u */
22c213
     ret = virtio_loop(se);
22c213
 
22c213
     fuse_session_unmount(se);
22c213
+    cleanup_capng();
22c213
 err_out3:
22c213
     fuse_remove_signal_handlers(se);
22c213
 err_out2:
22c213
-- 
22c213
1.8.3.1
22c213