From: Stefan Hajnoczi <stefanha@redhat.com>
To: Miklos Szeredi <mszeredi@redhat.com>
Cc: Sergio Lopez Pascual <slp@redhat.com>,
QEMU Developers <qemu-devel@nongnu.org>,
P J P <ppandit@redhat.com>, virtio-fs-list <virtio-fs@redhat.com>,
Alex Xu <alex@alxu.ca>,
"Dr. David Alan Gilbert" <dgilbert@redhat.com>,
Vivek Goyal <vgoyal@redhat.com>
Subject: Re: [PATCH] virtiofsd: prevent opening of special files (CVE-2020-35517)
Date: Tue, 26 Jan 2021 10:18:39 +0000 [thread overview]
Message-ID: <20210126101839.GC226981@stefanha-x1.localdomain> (raw)
In-Reply-To: <CAOssrKfjLrR0TXqPgk7sYAz9xiuNankgQpOtX69-zXWaGOnu6w@mail.gmail.com>
[-- Attachment #1: Type: text/plain, Size: 1101 bytes --]
On Mon, Jan 25, 2021 at 05:12:23PM +0100, Miklos Szeredi wrote:
> On Thu, Jan 21, 2021 at 3:44 PM Stefan Hajnoczi <stefanha@redhat.com> wrote:
>
> > This patch adds the missing checks to virtiofsd. This is a short-term
> > solution because it does not prevent a compromised virtiofsd process
> > from opening device nodes on the host.
>
> I think the proper solution is adding support to the host in order to
> restrict opens on filesystems that virtiofsd has access to.
>
> My idea was to add a "force_nodev" mount option that cannot be
> disabled and will make propagated mounts also be marked
> "force_nodev,nodev".
Interesting idea! Mount options that are relevant:
* noexec
* nosuid
* nodev
* nosymfollow
Do you have time to work on the force_* mount options?
> A possibly simpler solution is to extend seccomp to restrict the
> process itself from being able to open special files. Not sure if
> that's within the scope of seccomp though.
I don't think seccomp can provide that restriction since it's unrelated
to the syscall or its arguments.
Stefan
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]
WARNING: multiple messages have this Message-ID (diff)
From: Stefan Hajnoczi <stefanha@redhat.com>
To: Miklos Szeredi <mszeredi@redhat.com>
Cc: QEMU Developers <qemu-devel@nongnu.org>,
P J P <ppandit@redhat.com>, virtio-fs-list <virtio-fs@redhat.com>,
Alex Xu <alex@alxu.ca>, Vivek Goyal <vgoyal@redhat.com>
Subject: Re: [Virtio-fs] [PATCH] virtiofsd: prevent opening of special files (CVE-2020-35517)
Date: Tue, 26 Jan 2021 10:18:39 +0000 [thread overview]
Message-ID: <20210126101839.GC226981@stefanha-x1.localdomain> (raw)
In-Reply-To: <CAOssrKfjLrR0TXqPgk7sYAz9xiuNankgQpOtX69-zXWaGOnu6w@mail.gmail.com>
[-- Attachment #1: Type: text/plain, Size: 1101 bytes --]
On Mon, Jan 25, 2021 at 05:12:23PM +0100, Miklos Szeredi wrote:
> On Thu, Jan 21, 2021 at 3:44 PM Stefan Hajnoczi <stefanha@redhat.com> wrote:
>
> > This patch adds the missing checks to virtiofsd. This is a short-term
> > solution because it does not prevent a compromised virtiofsd process
> > from opening device nodes on the host.
>
> I think the proper solution is adding support to the host in order to
> restrict opens on filesystems that virtiofsd has access to.
>
> My idea was to add a "force_nodev" mount option that cannot be
> disabled and will make propagated mounts also be marked
> "force_nodev,nodev".
Interesting idea! Mount options that are relevant:
* noexec
* nosuid
* nodev
* nosymfollow
Do you have time to work on the force_* mount options?
> A possibly simpler solution is to extend seccomp to restrict the
> process itself from being able to open special files. Not sure if
> that's within the scope of seccomp though.
I don't think seccomp can provide that restriction since it's unrelated
to the syscall or its arguments.
Stefan
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]
next prev parent reply other threads:[~2021-01-26 10:20 UTC|newest]
Thread overview: 28+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-01-21 14:44 [PATCH] virtiofsd: prevent opening of special files (CVE-2020-35517) Stefan Hajnoczi
2021-01-21 14:44 ` [Virtio-fs] " Stefan Hajnoczi
2021-01-21 14:48 ` Daniel P. Berrangé
2021-01-21 14:48 ` [Virtio-fs] " Daniel P. Berrangé
2021-01-22 15:49 ` Vivek Goyal
2021-01-22 15:49 ` [Virtio-fs] " Vivek Goyal
2021-01-25 14:53 ` Stefan Hajnoczi
2021-01-25 14:53 ` [Virtio-fs] " Stefan Hajnoczi
2021-01-21 14:50 ` alex--- via
2021-01-21 14:50 ` [Virtio-fs] " Alex Xu
2021-01-21 15:32 ` Laszlo Ersek
2021-01-21 15:32 ` [Virtio-fs] " Laszlo Ersek
2021-01-21 15:52 ` alex--- via
2021-01-21 15:52 ` [Virtio-fs] " Alex Xu
2021-01-21 17:07 ` Laszlo Ersek
2021-01-21 17:07 ` [Virtio-fs] " Laszlo Ersek
2021-01-21 19:00 ` Dr. David Alan Gilbert
2021-01-21 19:00 ` [Virtio-fs] " Dr. David Alan Gilbert
2021-01-22 15:40 ` Vivek Goyal
2021-01-22 15:40 ` [Virtio-fs] " Vivek Goyal
2021-01-26 10:10 ` Stefan Hajnoczi
2021-01-26 10:10 ` [Virtio-fs] " Stefan Hajnoczi
2021-01-25 16:12 ` Miklos Szeredi
2021-01-25 16:12 ` [Virtio-fs] " Miklos Szeredi
2021-01-26 10:18 ` Stefan Hajnoczi [this message]
2021-01-26 10:18 ` Stefan Hajnoczi
2021-01-26 10:27 ` Miklos Szeredi
2021-01-26 10:27 ` [Virtio-fs] " Miklos Szeredi
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210126101839.GC226981@stefanha-x1.localdomain \
--to=stefanha@redhat.com \
--cc=alex@alxu.ca \
--cc=dgilbert@redhat.com \
--cc=mszeredi@redhat.com \
--cc=ppandit@redhat.com \
--cc=qemu-devel@nongnu.org \
--cc=slp@redhat.com \
--cc=vgoyal@redhat.com \
--cc=virtio-fs@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.