From af14ef1dba9356e566c9c7531b8fd23361c2b16d Mon Sep 17 00:00:00 2001 From: "Dr. David Alan Gilbert" Date: Mon, 27 Jan 2020 19:01:12 +0100 Subject: [PATCH 041/116] virtiofsd: passthrough_ll: create new files in caller's context MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit RH-Author: Dr. David Alan Gilbert Message-id: <20200127190227.40942-38-dgilbert@redhat.com> Patchwork-id: 93488 O-Subject: [RHEL-AV-8.2 qemu-kvm PATCH 037/112] virtiofsd: passthrough_ll: create new files in caller's context Bugzilla: 1694164 RH-Acked-by: Philippe Mathieu-Daudé RH-Acked-by: Stefan Hajnoczi RH-Acked-by: Sergio Lopez Pascual From: Vivek Goyal We need to create files in the caller's context. Otherwise after creating a file, the caller might not be able to do file operations on that file. Changed effective uid/gid to caller's uid/gid, create file and then switch back to uid/gid 0. Use syscall(setresuid, ...) otherwise glibc does some magic to change EUID in all threads, which is not what we want. Signed-off-by: Vivek Goyal Signed-off-by: Miklos Szeredi Signed-off-by: Dr. David Alan Gilbert (cherry picked from commit 929cfb7a9a1b101cdfc9ac19807ecab4c81a13e4) Signed-off-by: Miroslav Rezanina --- tools/virtiofsd/passthrough_ll.c | 96 +++++++++++++++++++++++++++++++++++++--- 1 file changed, 91 insertions(+), 5 deletions(-) diff --git a/tools/virtiofsd/passthrough_ll.c b/tools/virtiofsd/passthrough_ll.c index cd27c09..5e06179 100644 --- a/tools/virtiofsd/passthrough_ll.c +++ b/tools/virtiofsd/passthrough_ll.c @@ -50,6 +50,7 @@ #include #include #include +#include #include #include @@ -83,6 +84,11 @@ struct lo_inode { uint64_t refcount; /* protected by lo->mutex */ }; +struct lo_cred { + uid_t euid; + gid_t egid; +}; + enum { CACHE_NEVER, CACHE_NORMAL, @@ -383,6 +389,69 @@ static void lo_lookup(fuse_req_t req, fuse_ino_t parent, const char *name) } } +/* + * On some archs, setres*id is limited to 2^16 but they + * provide setres*id32 variants that allow 2^32. + * Others just let setres*id do 2^32 anyway. + */ +#ifdef SYS_setresgid32 +#define OURSYS_setresgid SYS_setresgid32 +#else +#define OURSYS_setresgid SYS_setresgid +#endif + +#ifdef SYS_setresuid32 +#define OURSYS_setresuid SYS_setresuid32 +#else +#define OURSYS_setresuid SYS_setresuid +#endif + +/* + * Change to uid/gid of caller so that file is created with + * ownership of caller. + * TODO: What about selinux context? + */ +static int lo_change_cred(fuse_req_t req, struct lo_cred *old) +{ + int res; + + old->euid = geteuid(); + old->egid = getegid(); + + res = syscall(OURSYS_setresgid, -1, fuse_req_ctx(req)->gid, -1); + if (res == -1) { + return errno; + } + + res = syscall(OURSYS_setresuid, -1, fuse_req_ctx(req)->uid, -1); + if (res == -1) { + int errno_save = errno; + + syscall(OURSYS_setresgid, -1, old->egid, -1); + return errno_save; + } + + return 0; +} + +/* Regain Privileges */ +static void lo_restore_cred(struct lo_cred *old) +{ + int res; + + res = syscall(OURSYS_setresuid, -1, old->euid, -1); + if (res == -1) { + fuse_log(FUSE_LOG_ERR, "seteuid(%u): %m\n", old->euid); + exit(1); + } + + res = syscall(OURSYS_setresgid, -1, old->egid, -1); + if (res == -1) { + fuse_log(FUSE_LOG_ERR, "setegid(%u): %m\n", old->egid); + exit(1); + } +} + static void lo_mknod_symlink(fuse_req_t req, fuse_ino_t parent, const char *name, mode_t mode, dev_t rdev, const char *link) @@ -391,12 +460,21 @@ static void lo_mknod_symlink(fuse_req_t req, fuse_ino_t parent, int saverr; struct lo_inode *dir = lo_inode(req, parent); struct fuse_entry_param e; + struct lo_cred old = {}; saverr = ENOMEM; + saverr = lo_change_cred(req, &old); + if (saverr) { + goto out; + } + res = mknod_wrapper(dir->fd, name, link, mode, rdev); saverr = errno; + + lo_restore_cred(&old); + if (res == -1) { goto out; } @@ -794,26 +872,34 @@ static void lo_create(fuse_req_t req, fuse_ino_t parent, const char *name, struct lo_data *lo = lo_data(req); struct fuse_entry_param e; int err; + struct lo_cred old = {}; if (lo_debug(req)) { fuse_log(FUSE_LOG_DEBUG, "lo_create(parent=%" PRIu64 ", name=%s)\n", parent, name); } + err = lo_change_cred(req, &old); + if (err) { + goto out; + } + fd = openat(lo_fd(req, parent), name, (fi->flags | O_CREAT) & ~O_NOFOLLOW, mode); - if (fd == -1) { - return (void)fuse_reply_err(req, errno); - } + err = fd == -1 ? errno : 0; + lo_restore_cred(&old); - fi->fh = fd; + if (!err) { + fi->fh = fd; + err = lo_do_lookup(req, parent, name, &e); + } if (lo->cache == CACHE_NEVER) { fi->direct_io = 1; } else if (lo->cache == CACHE_ALWAYS) { fi->keep_cache = 1; } - err = lo_do_lookup(req, parent, name, &e); +out: if (err) { fuse_reply_err(req, err); } else { -- 1.8.3.1