From: "Dr. David Alan Gilbert" <dgilbert@redhat.com> To: Max Reitz <mreitz@redhat.com> Cc: virtio-fs@redhat.com, qemu-devel@nongnu.org, Stefan Hajnoczi <stefanha@redhat.com>, qemu-stable@nongnu.org Subject: Re: [PATCH] virtiofsd: Whitelist fchmod Date: Wed, 17 Jun 2020 10:36:13 +0100 [thread overview] Message-ID: <20200617093613.GA7075@work-vm> (raw) In-Reply-To: <20200608093111.14942-1-mreitz@redhat.com> * Max Reitz (mreitz@redhat.com) wrote: > lo_setattr() invokes fchmod() in a rarely used code path, so it should > be whitelisted or virtiofsd will crash with EBADSYS. > > Said code path can be triggered for example as follows: > > On the host, in the shared directory, create a file with the sticky bit > set and a security.capability xattr: > (1) # touch foo > (2) # chmod u+s foo > (3) # setcap '' foo > > Then in the guest let some process truncate that file after it has > dropped all of its capabilities (at least CAP_FSETID): > > int main(int argc, char *argv[]) > { > capng_setpid(getpid()); > capng_clear(CAPNG_SELECT_BOTH); > capng_updatev(CAPNG_ADD, CAPNG_PERMITTED | CAPNG_EFFECTIVE, 0); > capng_apply(CAPNG_SELECT_BOTH); > > ftruncate(open(argv[1], O_RDWR), 0); > } > > This will cause the guest kernel to drop the sticky bit (i.e. perform a > mode change) as part of the truncate (where FATTR_FH is set), and that > will cause virtiofsd to invoke fchmod() instead of fchmodat(). > > (A similar configuration exists further below with futimens() vs. > utimensat(), but the former is not a syscall but just a wrapper for the > latter, so no further whitelisting is required.) > > Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=1842667 > Reported-by: Qian Cai <caiqian@redhat.com> > Cc: qemu-stable@nongnu.org > Signed-off-by: Max Reitz <mreitz@redhat.com> Queued. > --- > tools/virtiofsd/seccomp.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/tools/virtiofsd/seccomp.c b/tools/virtiofsd/seccomp.c > index bd9e7b083c..3b1522acdd 100644 > --- a/tools/virtiofsd/seccomp.c > +++ b/tools/virtiofsd/seccomp.c > @@ -42,6 +42,7 @@ static const int syscall_whitelist[] = { > SCMP_SYS(exit_group), > SCMP_SYS(fallocate), > SCMP_SYS(fchdir), > + SCMP_SYS(fchmod), > SCMP_SYS(fchmodat), > SCMP_SYS(fchownat), > SCMP_SYS(fcntl), > -- > 2.26.2 > > -- Dr. David Alan Gilbert / dgilbert@redhat.com / Manchester, UK
WARNING: multiple messages have this Message-ID (diff)
From: "Dr. David Alan Gilbert" <dgilbert@redhat.com> To: Max Reitz <mreitz@redhat.com> Cc: virtio-fs@redhat.com, qemu-devel@nongnu.org, qemu-stable@nongnu.org Subject: Re: [Virtio-fs] [PATCH] virtiofsd: Whitelist fchmod Date: Wed, 17 Jun 2020 10:36:13 +0100 [thread overview] Message-ID: <20200617093613.GA7075@work-vm> (raw) In-Reply-To: <20200608093111.14942-1-mreitz@redhat.com> * Max Reitz (mreitz@redhat.com) wrote: > lo_setattr() invokes fchmod() in a rarely used code path, so it should > be whitelisted or virtiofsd will crash with EBADSYS. > > Said code path can be triggered for example as follows: > > On the host, in the shared directory, create a file with the sticky bit > set and a security.capability xattr: > (1) # touch foo > (2) # chmod u+s foo > (3) # setcap '' foo > > Then in the guest let some process truncate that file after it has > dropped all of its capabilities (at least CAP_FSETID): > > int main(int argc, char *argv[]) > { > capng_setpid(getpid()); > capng_clear(CAPNG_SELECT_BOTH); > capng_updatev(CAPNG_ADD, CAPNG_PERMITTED | CAPNG_EFFECTIVE, 0); > capng_apply(CAPNG_SELECT_BOTH); > > ftruncate(open(argv[1], O_RDWR), 0); > } > > This will cause the guest kernel to drop the sticky bit (i.e. perform a > mode change) as part of the truncate (where FATTR_FH is set), and that > will cause virtiofsd to invoke fchmod() instead of fchmodat(). > > (A similar configuration exists further below with futimens() vs. > utimensat(), but the former is not a syscall but just a wrapper for the > latter, so no further whitelisting is required.) > > Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=1842667 > Reported-by: Qian Cai <caiqian@redhat.com> > Cc: qemu-stable@nongnu.org > Signed-off-by: Max Reitz <mreitz@redhat.com> Queued. > --- > tools/virtiofsd/seccomp.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/tools/virtiofsd/seccomp.c b/tools/virtiofsd/seccomp.c > index bd9e7b083c..3b1522acdd 100644 > --- a/tools/virtiofsd/seccomp.c > +++ b/tools/virtiofsd/seccomp.c > @@ -42,6 +42,7 @@ static const int syscall_whitelist[] = { > SCMP_SYS(exit_group), > SCMP_SYS(fallocate), > SCMP_SYS(fchdir), > + SCMP_SYS(fchmod), > SCMP_SYS(fchmodat), > SCMP_SYS(fchownat), > SCMP_SYS(fcntl), > -- > 2.26.2 > > -- Dr. David Alan Gilbert / dgilbert@redhat.com / Manchester, UK
next prev parent reply other threads:[~2020-06-17 9:37 UTC|newest] Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top 2020-06-08 9:31 [PATCH] virtiofsd: Whitelist fchmod Max Reitz 2020-06-08 9:31 ` [Virtio-fs] " Max Reitz 2020-06-08 15:57 ` Dr. David Alan Gilbert 2020-06-08 15:57 ` [Virtio-fs] " Dr. David Alan Gilbert 2020-06-09 12:31 ` Vivek Goyal 2020-06-17 9:36 ` Dr. David Alan Gilbert [this message] 2020-06-17 9:36 ` Dr. David Alan Gilbert
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20200617093613.GA7075@work-vm \ --to=dgilbert@redhat.com \ --cc=mreitz@redhat.com \ --cc=qemu-devel@nongnu.org \ --cc=qemu-stable@nongnu.org \ --cc=stefanha@redhat.com \ --cc=virtio-fs@redhat.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.