119 lines
4.0 KiB
Diff
119 lines
4.0 KiB
Diff
From: Stefan Hajnoczi <stefanha@redhat.com>
|
|
Date: Tue, 6 Oct 2020 10:58:26 +0100
|
|
Subject: [PATCH] virtiofsd: avoid /proc/self/fd tempdir
|
|
|
|
In order to prevent /proc/self/fd escapes a temporary directory is
|
|
created where /proc/self/fd is bind-mounted. This doesn't work on
|
|
read-only file systems.
|
|
|
|
Avoid the temporary directory by bind-mounting /proc/self/fd over /proc.
|
|
This does not affect other processes since we remounted / with MS_REC |
|
|
MS_SLAVE. /proc must exist and virtiofsd does not use it so it's safe to
|
|
do this.
|
|
|
|
Path traversal can be tested with the following function:
|
|
|
|
static void test_proc_fd_escape(struct lo_data *lo)
|
|
{
|
|
int fd;
|
|
int level = 0;
|
|
ino_t last_ino = 0;
|
|
|
|
fd = lo->proc_self_fd;
|
|
for (;;) {
|
|
struct stat st;
|
|
|
|
if (fstat(fd, &st) != 0) {
|
|
perror("fstat");
|
|
return;
|
|
}
|
|
if (last_ino && st.st_ino == last_ino) {
|
|
fprintf(stderr, "inode number unchanged, stopping\n");
|
|
return;
|
|
}
|
|
last_ino = st.st_ino;
|
|
|
|
fprintf(stderr, "Level %d dev %lu ino %lu\n", level,
|
|
(unsigned long)st.st_dev,
|
|
(unsigned long)last_ino);
|
|
fd = openat(fd, "..", O_PATH | O_DIRECTORY | O_NOFOLLOW);
|
|
level++;
|
|
}
|
|
}
|
|
|
|
Before and after this patch only Level 0 is displayed. Without
|
|
/proc/self/fd bind-mount protection it is possible to traverse parent
|
|
directories.
|
|
|
|
Fixes: 397ae982f4df4 ("virtiofsd: jail lo->proc_self_fd")
|
|
Cc: Miklos Szeredi <mszeredi@redhat.com>
|
|
Cc: Jens Freimann <jfreimann@redhat.com>
|
|
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
|
|
Message-Id: <20201006095826.59813-1-stefanha@redhat.com>
|
|
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
|
|
Tested-by: Jens Freimann <jfreimann@redhat.com>
|
|
Reviewed-by: Jens Freimann <jfreimann@redhat.com>
|
|
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
|
|
---
|
|
tools/virtiofsd/passthrough_ll.c | 34 +++++++++++---------------------
|
|
1 file changed, 11 insertions(+), 23 deletions(-)
|
|
|
|
diff --git a/tools/virtiofsd/passthrough_ll.c b/tools/virtiofsd/passthrough_ll.c
|
|
index 50a164a599..b865dc564b 100644
|
|
--- a/tools/virtiofsd/passthrough_ll.c
|
|
+++ b/tools/virtiofsd/passthrough_ll.c
|
|
@@ -2386,8 +2386,6 @@ static void setup_wait_parent_capabilities(void)
|
|
static void setup_namespaces(struct lo_data *lo, struct fuse_session *se)
|
|
{
|
|
pid_t child;
|
|
- char template[] = "virtiofsd-XXXXXX";
|
|
- char *tmpdir;
|
|
|
|
/*
|
|
* Create a new pid namespace for *child* processes. We'll have to
|
|
@@ -2451,33 +2449,23 @@ static void setup_namespaces(struct lo_data *lo, struct fuse_session *se)
|
|
exit(1);
|
|
}
|
|
|
|
- tmpdir = mkdtemp(template);
|
|
- if (!tmpdir) {
|
|
- fuse_log(FUSE_LOG_ERR, "tmpdir(%s): %m\n", template);
|
|
- exit(1);
|
|
- }
|
|
-
|
|
- if (mount("/proc/self/fd", tmpdir, NULL, MS_BIND, NULL) < 0) {
|
|
- fuse_log(FUSE_LOG_ERR, "mount(/proc/self/fd, %s, MS_BIND): %m\n",
|
|
- tmpdir);
|
|
+ /*
|
|
+ * We only need /proc/self/fd. Prevent ".." from accessing parent
|
|
+ * directories of /proc/self/fd by bind-mounting it over /proc. Since / was
|
|
+ * previously remounted with MS_REC | MS_SLAVE this mount change only
|
|
+ * affects our process.
|
|
+ */
|
|
+ if (mount("/proc/self/fd", "/proc", NULL, MS_BIND, NULL) < 0) {
|
|
+ fuse_log(FUSE_LOG_ERR, "mount(/proc/self/fd, MS_BIND): %m\n");
|
|
exit(1);
|
|
}
|
|
|
|
- /* Now we can get our /proc/self/fd directory file descriptor */
|
|
- lo->proc_self_fd = open(tmpdir, O_PATH);
|
|
+ /* Get the /proc (actually /proc/self/fd, see above) file descriptor */
|
|
+ lo->proc_self_fd = open("/proc", O_PATH);
|
|
if (lo->proc_self_fd == -1) {
|
|
- fuse_log(FUSE_LOG_ERR, "open(%s, O_PATH): %m\n", tmpdir);
|
|
+ fuse_log(FUSE_LOG_ERR, "open(/proc, O_PATH): %m\n");
|
|
exit(1);
|
|
}
|
|
-
|
|
- if (umount2(tmpdir, MNT_DETACH) < 0) {
|
|
- fuse_log(FUSE_LOG_ERR, "umount2(%s, MNT_DETACH): %m\n", tmpdir);
|
|
- exit(1);
|
|
- }
|
|
-
|
|
- if (rmdir(tmpdir) < 0) {
|
|
- fuse_log(FUSE_LOG_ERR, "rmdir(%s): %m\n", tmpdir);
|
|
- }
|
|
}
|
|
|
|
/*
|