From 6d9aff83ef5d50a65fad4f4218073bd4aa3e6902 Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Tue, 10 Nov 2015 20:08:04 +0100 Subject: [PATCH] journald: never accept fds from file systems with mandatory locking enabled This is pretty much a work-around for a security vulnerability in kernels that allow unprivileged user namespaces. Fixes #1822. Cherry-picked from: 1e603a482f57edb1fb863dbf23b868cf5854e004 Resolves: #1501017 --- src/journal/journald-native.c | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) diff --git a/src/journal/journald-native.c b/src/journal/journald-native.c index 2c9cf6e7a..fdb1a38dd 100644 --- a/src/journal/journald-native.c +++ b/src/journal/journald-native.c @@ -23,6 +23,7 @@ #include #include #include +#include #include "socket-util.h" #include "path-util.h" @@ -391,8 +392,37 @@ void server_process_native_file( assert_se(munmap(p, ps) >= 0); } else { _cleanup_free_ void *p = NULL; + struct statvfs vfs; ssize_t n; + if (fstatvfs(fd, &vfs) < 0) { + log_error_errno(errno, "Failed to stat file system of passed file, ignoring: %m"); + return; + } + + /* Refuse operating on file systems that have + * mandatory locking enabled, see: + * + * https://github.com/systemd/systemd/issues/1822 + */ + if (vfs.f_flag & ST_MANDLOCK) { + log_error("Received file descriptor from file system with mandatory locking enable, refusing."); + return; + } + + /* Make the fd non-blocking. On regular files this has + * the effect of bypassing mandatory locking. Of + * course, this should normally not be necessary given + * the check above, but let's better be safe than + * sorry, after all NFS is pretty confusing regarding + * file system flags, and we better don't trust it, + * and so is SMB. */ + r = fd_nonblock(fd, true); + if (r < 0) { + log_error_errno(r, "Failed to make fd non-blocking, ignoring: %m"); + return; + } + /* The file is not sealed, we can't map the file here, since * clients might then truncate it and trigger a SIGBUS for * us. So let's stupidly read it */