* [Qemu-devel] [PATCH] slirp: use less predictable directory name in /tmp for smb config (CVE-2015-4037)
@ 2015-05-28 11:15 Michael Tokarev
2015-05-28 11:36 ` Markus Armbruster
` (2 more replies)
0 siblings, 3 replies; 6+ messages in thread
From: Michael Tokarev @ 2015-05-28 11:15 UTC (permalink / raw)
To: qemu-devel; +Cc: qemu-trivial, Jan Kiszka, Michael Tokarev
In this version I used mkdtemp(3) which is:
_BSD_SOURCE
|| /* Since glibc 2.10: */
(_POSIX_C_SOURCE >= 200809L || _XOPEN_SOURCE >= 700)
so should be available on systems we care about.
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
net/slirp.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
diff --git a/net/slirp.c b/net/slirp.c
index 9bbed74..0ad32ad 100644
--- a/net/slirp.c
+++ b/net/slirp.c
@@ -481,7 +481,6 @@ static void slirp_smb_cleanup(SlirpState *s)
static int slirp_smb(SlirpState* s, const char *exported_dir,
struct in_addr vserver_addr)
{
- static int instance;
char smb_conf[128];
char smb_cmdline[128];
struct passwd *passwd;
@@ -505,9 +504,8 @@ static int slirp_smb(SlirpState* s, const char *exported_dir,
return -1;
}
- snprintf(s->smb_dir, sizeof(s->smb_dir), "/tmp/qemu-smb.%ld-%d",
- (long)getpid(), instance++);
- if (mkdir(s->smb_dir, 0700) < 0) {
+ strcpy(s->smb_dir, "/tmp/qemu-smb.XXXXXX");
+ if (!mkdtemp(s->smb_dir)) {
error_report("could not create samba server dir '%s'", s->smb_dir);
return -1;
}
--
2.1.4
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [Qemu-devel] [PATCH] slirp: use less predictable directory name in /tmp for smb config (CVE-2015-4037)
2015-05-28 11:15 [Qemu-devel] [PATCH] slirp: use less predictable directory name in /tmp for smb config (CVE-2015-4037) Michael Tokarev
@ 2015-05-28 11:36 ` Markus Armbruster
2015-06-01 8:01 ` Markus Armbruster
2015-06-01 11:28 ` Miroslav Rezanina
2 siblings, 0 replies; 6+ messages in thread
From: Markus Armbruster @ 2015-05-28 11:36 UTC (permalink / raw)
To: Michael Tokarev; +Cc: qemu-trivial, Jan Kiszka, qemu-devel
Michael Tokarev <mjt@tls.msk.ru> writes:
> In this version I used mkdtemp(3) which is:
>
> _BSD_SOURCE
> || /* Since glibc 2.10: */
> (_POSIX_C_SOURCE >= 200809L || _XOPEN_SOURCE >= 700)
In short, it's POSIX.1-2008.
> so should be available on systems we care about.
Yes.
> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [Qemu-devel] [PATCH] slirp: use less predictable directory name in /tmp for smb config (CVE-2015-4037)
2015-05-28 11:15 [Qemu-devel] [PATCH] slirp: use less predictable directory name in /tmp for smb config (CVE-2015-4037) Michael Tokarev
2015-05-28 11:36 ` Markus Armbruster
@ 2015-06-01 8:01 ` Markus Armbruster
2015-06-01 8:44 ` Michael Tokarev
2015-06-01 11:28 ` Miroslav Rezanina
2 siblings, 1 reply; 6+ messages in thread
From: Markus Armbruster @ 2015-06-01 8:01 UTC (permalink / raw)
To: Michael Tokarev
Cc: pmatouse, P J P, qemu-trivial, Jan Kiszka, qemu-devel, Miroslav Rezanina
Michael Tokarev <mjt@tls.msk.ru> writes:
> In this version I used mkdtemp(3) which is:
>
> _BSD_SOURCE
> || /* Since glibc 2.10: */
> (_POSIX_C_SOURCE >= 200809L || _XOPEN_SOURCE >= 700)
>
> so should be available on systems we care about.
>
> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
> ---
> net/slirp.c | 6 ++----
> 1 file changed, 2 insertions(+), 4 deletions(-)
>
> diff --git a/net/slirp.c b/net/slirp.c
> index 9bbed74..0ad32ad 100644
> --- a/net/slirp.c
> +++ b/net/slirp.c
> @@ -481,7 +481,6 @@ static void slirp_smb_cleanup(SlirpState *s)
> static int slirp_smb(SlirpState* s, const char *exported_dir,
> struct in_addr vserver_addr)
> {
> - static int instance;
> char smb_conf[128];
> char smb_cmdline[128];
> struct passwd *passwd;
> @@ -505,9 +504,8 @@ static int slirp_smb(SlirpState* s, const char *exported_dir,
> return -1;
> }
>
> - snprintf(s->smb_dir, sizeof(s->smb_dir), "/tmp/qemu-smb.%ld-%d",
> - (long)getpid(), instance++);
> - if (mkdir(s->smb_dir, 0700) < 0) {
> + strcpy(s->smb_dir, "/tmp/qemu-smb.XXXXXX");
> + if (!mkdtemp(s->smb_dir)) {
> error_report("could not create samba server dir '%s'", s->smb_dir);
> return -1;
> }
Uh, I have to suspend my R-by. This clobbers s->smb_dir[] when
mkdtemp() fails. Is that safe? Explain why, and get my R-by back.
The alternative "[PATCH] net: fix insecure temporary file creation in
SLiRP" doesn't clobber it.
http://lists.nongnu.org/archive/html/qemu-devel/2015-06/msg00005.html
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [Qemu-devel] [PATCH] slirp: use less predictable directory name in /tmp for smb config (CVE-2015-4037)
2015-06-01 8:01 ` Markus Armbruster
@ 2015-06-01 8:44 ` Michael Tokarev
2015-06-01 11:23 ` Markus Armbruster
0 siblings, 1 reply; 6+ messages in thread
From: Michael Tokarev @ 2015-06-01 8:44 UTC (permalink / raw)
To: Markus Armbruster
Cc: pmatouse, P J P, qemu-trivial, Jan Kiszka, qemu-devel, Miroslav Rezanina
01.06.2015 11:01, Markus Armbruster wrote:
[]
>> - snprintf(s->smb_dir, sizeof(s->smb_dir), "/tmp/qemu-smb.%ld-%d",
>> - (long)getpid(), instance++);
>> - if (mkdir(s->smb_dir, 0700) < 0) {
>> + strcpy(s->smb_dir, "/tmp/qemu-smb.XXXXXX");
>> + if (!mkdtemp(s->smb_dir)) {
>> error_report("could not create samba server dir '%s'", s->smb_dir);
>> return -1;
>> }
>
> Uh, I have to suspend my R-by. This clobbers s->smb_dir[] when
> mkdtemp() fails. Is that safe? Explain why, and get my R-by back.
At least this is not different from the original behavour.
The only place where this variable is used is in the slirp_smb_cleanup()
function, which, if smb_dir[0] != 0, does rm -rf on it.
I think it will be better to add s->smb_dir[0] = 0 here before return.
On the other hand this isn't really that important given when we can
expect mkdtemp() to fail.
Thanks,
/mjt
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [Qemu-devel] [PATCH] slirp: use less predictable directory name in /tmp for smb config (CVE-2015-4037)
2015-06-01 8:44 ` Michael Tokarev
@ 2015-06-01 11:23 ` Markus Armbruster
0 siblings, 0 replies; 6+ messages in thread
From: Markus Armbruster @ 2015-06-01 11:23 UTC (permalink / raw)
To: Michael Tokarev
Cc: pmatouse, P J P, qemu-trivial, Jan Kiszka, qemu-devel, Miroslav Rezanina
Michael Tokarev <mjt@tls.msk.ru> writes:
> 01.06.2015 11:01, Markus Armbruster wrote:
> []
>>> - snprintf(s->smb_dir, sizeof(s->smb_dir), "/tmp/qemu-smb.%ld-%d",
>>> - (long)getpid(), instance++);
>>> - if (mkdir(s->smb_dir, 0700) < 0) {
>>> + strcpy(s->smb_dir, "/tmp/qemu-smb.XXXXXX");
>>> + if (!mkdtemp(s->smb_dir)) {
>>> error_report("could not create samba server dir '%s'", s->smb_dir);
>>> return -1;
>>> }
>>
>> Uh, I have to suspend my R-by. This clobbers s->smb_dir[] when
>> mkdtemp() fails. Is that safe? Explain why, and get my R-by back.
>
> At least this is not different from the original behavour.
Fair enough, R-by unsuspended.
> The only place where this variable is used is in the slirp_smb_cleanup()
> function, which, if smb_dir[0] != 0, does rm -rf on it.
> I think it will be better to add s->smb_dir[0] = 0 here before return.
Makes sense.
> On the other hand this isn't really that important given when we can
> expect mkdtemp() to fail.
Not sure I got this part. Not sure I need to :)
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [Qemu-devel] [PATCH] slirp: use less predictable directory name in /tmp for smb config (CVE-2015-4037)
2015-05-28 11:15 [Qemu-devel] [PATCH] slirp: use less predictable directory name in /tmp for smb config (CVE-2015-4037) Michael Tokarev
2015-05-28 11:36 ` Markus Armbruster
2015-06-01 8:01 ` Markus Armbruster
@ 2015-06-01 11:28 ` Miroslav Rezanina
2 siblings, 0 replies; 6+ messages in thread
From: Miroslav Rezanina @ 2015-06-01 11:28 UTC (permalink / raw)
To: Michael Tokarev; +Cc: qemu-trivial, Jan Kiszka, qemu-devel
On Thu, May 28, 2015 at 02:15:43PM +0300, Michael Tokarev wrote:
> In this version I used mkdtemp(3) which is:
>
> _BSD_SOURCE
> || /* Since glibc 2.10: */
> (_POSIX_C_SOURCE >= 200809L || _XOPEN_SOURCE >= 700)
>
> so should be available on systems we care about.
>
> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
> ---
> net/slirp.c | 6 ++----
> 1 file changed, 2 insertions(+), 4 deletions(-)
>
> diff --git a/net/slirp.c b/net/slirp.c
> index 9bbed74..0ad32ad 100644
> --- a/net/slirp.c
> +++ b/net/slirp.c
> @@ -481,7 +481,6 @@ static void slirp_smb_cleanup(SlirpState *s)
> static int slirp_smb(SlirpState* s, const char *exported_dir,
> struct in_addr vserver_addr)
> {
> - static int instance;
> char smb_conf[128];
> char smb_cmdline[128];
> struct passwd *passwd;
> @@ -505,9 +504,8 @@ static int slirp_smb(SlirpState* s, const char *exported_dir,
> return -1;
> }
>
> - snprintf(s->smb_dir, sizeof(s->smb_dir), "/tmp/qemu-smb.%ld-%d",
> - (long)getpid(), instance++);
> - if (mkdir(s->smb_dir, 0700) < 0) {
> + strcpy(s->smb_dir, "/tmp/qemu-smb.XXXXXX");
> + if (!mkdtemp(s->smb_dir)) {
> error_report("could not create samba server dir '%s'", s->smb_dir);
> return -1;
> }
> --
> 2.1.4
>
>
I suggest to go with this patch as:
1) It was sent first
2) Is simplier
3) Keep original behavior
Reviewed-by: Miroslav Rezanina <mrezanin@redhat.com>
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2015-06-01 11:29 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2015-05-28 11:15 [Qemu-devel] [PATCH] slirp: use less predictable directory name in /tmp for smb config (CVE-2015-4037) Michael Tokarev
2015-05-28 11:36 ` Markus Armbruster
2015-06-01 8:01 ` Markus Armbruster
2015-06-01 8:44 ` Michael Tokarev
2015-06-01 11:23 ` Markus Armbruster
2015-06-01 11:28 ` Miroslav Rezanina
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.