All of lore.kernel.org
 help / color / mirror / Atom feed
From: Miklos Szeredi <mszeredi@redhat.com>
To: Stefan Hajnoczi <stefanha@redhat.com>
Cc: Sergio Lopez Pascual <slp@redhat.com>,
	QEMU Developers <qemu-devel@nongnu.org>,
	P J P <ppandit@redhat.com>, virtio-fs-list <virtio-fs@redhat.com>,
	Alex Xu <alex@alxu.ca>,
	"Dr. David Alan Gilbert" <dgilbert@redhat.com>,
	Vivek Goyal <vgoyal@redhat.com>
Subject: Re: [PATCH] virtiofsd: prevent opening of special files (CVE-2020-35517)
Date: Mon, 25 Jan 2021 17:12:23 +0100	[thread overview]
Message-ID: <CAOssrKfjLrR0TXqPgk7sYAz9xiuNankgQpOtX69-zXWaGOnu6w@mail.gmail.com> (raw)
In-Reply-To: <20210121144429.58885-1-stefanha@redhat.com>

On Thu, Jan 21, 2021 at 3:44 PM Stefan Hajnoczi <stefanha@redhat.com> wrote:

> This patch adds the missing checks to virtiofsd. This is a short-term
> solution because it does not prevent a compromised virtiofsd process
> from opening device nodes on the host.

I think the proper solution is adding support to the host in order to
restrict opens on filesystems that virtiofsd has access to.

My idea was to add a "force_nodev" mount option that cannot be
disabled and will make propagated mounts  also be marked
"force_nodev,nodev".

A possibly simpler solution is to extend seccomp to restrict the
process itself from being able to open special files.  Not sure if
that's within the scope of seccomp though.

Thanks,
Miklos



WARNING: multiple messages have this Message-ID (diff)
From: Miklos Szeredi <mszeredi@redhat.com>
To: Stefan Hajnoczi <stefanha@redhat.com>
Cc: QEMU Developers <qemu-devel@nongnu.org>,
	P J P <ppandit@redhat.com>, virtio-fs-list <virtio-fs@redhat.com>,
	Alex Xu <alex@alxu.ca>, Vivek Goyal <vgoyal@redhat.com>
Subject: Re: [Virtio-fs] [PATCH] virtiofsd: prevent opening of special files (CVE-2020-35517)
Date: Mon, 25 Jan 2021 17:12:23 +0100	[thread overview]
Message-ID: <CAOssrKfjLrR0TXqPgk7sYAz9xiuNankgQpOtX69-zXWaGOnu6w@mail.gmail.com> (raw)
In-Reply-To: <20210121144429.58885-1-stefanha@redhat.com>

On Thu, Jan 21, 2021 at 3:44 PM Stefan Hajnoczi <stefanha@redhat.com> wrote:

> This patch adds the missing checks to virtiofsd. This is a short-term
> solution because it does not prevent a compromised virtiofsd process
> from opening device nodes on the host.

I think the proper solution is adding support to the host in order to
restrict opens on filesystems that virtiofsd has access to.

My idea was to add a "force_nodev" mount option that cannot be
disabled and will make propagated mounts  also be marked
"force_nodev,nodev".

A possibly simpler solution is to extend seccomp to restrict the
process itself from being able to open special files.  Not sure if
that's within the scope of seccomp though.

Thanks,
Miklos


  parent reply	other threads:[~2021-01-25 16:14 UTC|newest]

Thread overview: 28+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-01-21 14:44 [PATCH] virtiofsd: prevent opening of special files (CVE-2020-35517) Stefan Hajnoczi
2021-01-21 14:44 ` [Virtio-fs] " Stefan Hajnoczi
2021-01-21 14:48 ` Daniel P. Berrangé
2021-01-21 14:48   ` [Virtio-fs] " Daniel P. Berrangé
2021-01-22 15:49   ` Vivek Goyal
2021-01-22 15:49     ` [Virtio-fs] " Vivek Goyal
2021-01-25 14:53   ` Stefan Hajnoczi
2021-01-25 14:53     ` [Virtio-fs] " Stefan Hajnoczi
2021-01-21 14:50 ` alex--- via
2021-01-21 14:50   ` [Virtio-fs] " Alex Xu
2021-01-21 15:32 ` Laszlo Ersek
2021-01-21 15:32   ` [Virtio-fs] " Laszlo Ersek
2021-01-21 15:52   ` alex--- via
2021-01-21 15:52     ` [Virtio-fs] " Alex Xu
2021-01-21 17:07     ` Laszlo Ersek
2021-01-21 17:07       ` [Virtio-fs] " Laszlo Ersek
2021-01-21 19:00 ` Dr. David Alan Gilbert
2021-01-21 19:00   ` [Virtio-fs] " Dr. David Alan Gilbert
2021-01-22 15:40 ` Vivek Goyal
2021-01-22 15:40   ` [Virtio-fs] " Vivek Goyal
2021-01-26 10:10   ` Stefan Hajnoczi
2021-01-26 10:10     ` [Virtio-fs] " Stefan Hajnoczi
2021-01-25 16:12 ` Miklos Szeredi [this message]
2021-01-25 16:12   ` Miklos Szeredi
2021-01-26 10:18   ` Stefan Hajnoczi
2021-01-26 10:18     ` [Virtio-fs] " Stefan Hajnoczi
2021-01-26 10:27     ` Miklos Szeredi
2021-01-26 10:27       ` [Virtio-fs] " Miklos Szeredi

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=CAOssrKfjLrR0TXqPgk7sYAz9xiuNankgQpOtX69-zXWaGOnu6w@mail.gmail.com \
    --to=mszeredi@redhat.com \
    --cc=alex@alxu.ca \
    --cc=dgilbert@redhat.com \
    --cc=ppandit@redhat.com \
    --cc=qemu-devel@nongnu.org \
    --cc=slp@redhat.com \
    --cc=stefanha@redhat.com \
    --cc=vgoyal@redhat.com \
    --cc=virtio-fs@redhat.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.