177 lines
4.9 KiB
Diff
177 lines
4.9 KiB
Diff
From e217ab392e0d4c770ec18dbfbe986771773cb557 Mon Sep 17 00:00:00 2001
|
|
From: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
|
|
Date: Mon, 27 Jan 2020 19:01:33 +0100
|
|
Subject: [PATCH 062/116] virtiofsd: Drop CAP_FSETID if client asked for it
|
|
MIME-Version: 1.0
|
|
Content-Type: text/plain; charset=UTF-8
|
|
Content-Transfer-Encoding: 8bit
|
|
|
|
RH-Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
|
|
Message-id: <20200127190227.40942-59-dgilbert@redhat.com>
|
|
Patchwork-id: 93513
|
|
O-Subject: [RHEL-AV-8.2 qemu-kvm PATCH 058/112] virtiofsd: Drop CAP_FSETID if client asked for it
|
|
Bugzilla: 1694164
|
|
RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
|
|
RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
|
|
RH-Acked-by: Sergio Lopez Pascual <slp@redhat.com>
|
|
|
|
From: Vivek Goyal <vgoyal@redhat.com>
|
|
|
|
If client requested killing setuid/setgid bits on file being written, drop
|
|
CAP_FSETID capability so that setuid/setgid bits are cleared upon write
|
|
automatically.
|
|
|
|
pjdfstest chown/12.t needs this.
|
|
|
|
Signed-off-by: Vivek Goyal <vgoyal@redhat.com>
|
|
dgilbert: reworked for libcap-ng
|
|
Reviewed-by: Misono Tomohiro <misono.tomohiro@jp.fujitsu.com>
|
|
Reviewed-by: Sergio Lopez <slp@redhat.com>
|
|
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
|
|
(cherry picked from commit ee88465224b3aed2596049caa28f86cbe0d5a3d0)
|
|
|
|
Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
|
|
---
|
|
tools/virtiofsd/passthrough_ll.c | 105 +++++++++++++++++++++++++++++++++++++++
|
|
1 file changed, 105 insertions(+)
|
|
|
|
diff --git a/tools/virtiofsd/passthrough_ll.c b/tools/virtiofsd/passthrough_ll.c
|
|
index 97e7c75..d53cb1e 100644
|
|
--- a/tools/virtiofsd/passthrough_ll.c
|
|
+++ b/tools/virtiofsd/passthrough_ll.c
|
|
@@ -201,6 +201,91 @@ static int load_capng(void)
|
|
return 0;
|
|
}
|
|
|
|
+/*
|
|
+ * Helpers for dropping and regaining effective capabilities. Returns 0
|
|
+ * on success, error otherwise
|
|
+ */
|
|
+static int drop_effective_cap(const char *cap_name, bool *cap_dropped)
|
|
+{
|
|
+ int cap, ret;
|
|
+
|
|
+ cap = capng_name_to_capability(cap_name);
|
|
+ if (cap < 0) {
|
|
+ ret = errno;
|
|
+ fuse_log(FUSE_LOG_ERR, "capng_name_to_capability(%s) failed:%s\n",
|
|
+ cap_name, strerror(errno));
|
|
+ goto out;
|
|
+ }
|
|
+
|
|
+ if (load_capng()) {
|
|
+ ret = errno;
|
|
+ fuse_log(FUSE_LOG_ERR, "load_capng() failed\n");
|
|
+ goto out;
|
|
+ }
|
|
+
|
|
+ /* We dont have this capability in effective set already. */
|
|
+ if (!capng_have_capability(CAPNG_EFFECTIVE, cap)) {
|
|
+ ret = 0;
|
|
+ goto out;
|
|
+ }
|
|
+
|
|
+ if (capng_update(CAPNG_DROP, CAPNG_EFFECTIVE, cap)) {
|
|
+ ret = errno;
|
|
+ fuse_log(FUSE_LOG_ERR, "capng_update(DROP,) failed\n");
|
|
+ goto out;
|
|
+ }
|
|
+
|
|
+ if (capng_apply(CAPNG_SELECT_CAPS)) {
|
|
+ ret = errno;
|
|
+ fuse_log(FUSE_LOG_ERR, "drop:capng_apply() failed\n");
|
|
+ goto out;
|
|
+ }
|
|
+
|
|
+ ret = 0;
|
|
+ if (cap_dropped) {
|
|
+ *cap_dropped = true;
|
|
+ }
|
|
+
|
|
+out:
|
|
+ return ret;
|
|
+}
|
|
+
|
|
+static int gain_effective_cap(const char *cap_name)
|
|
+{
|
|
+ int cap;
|
|
+ int ret = 0;
|
|
+
|
|
+ cap = capng_name_to_capability(cap_name);
|
|
+ if (cap < 0) {
|
|
+ ret = errno;
|
|
+ fuse_log(FUSE_LOG_ERR, "capng_name_to_capability(%s) failed:%s\n",
|
|
+ cap_name, strerror(errno));
|
|
+ goto out;
|
|
+ }
|
|
+
|
|
+ if (load_capng()) {
|
|
+ ret = errno;
|
|
+ fuse_log(FUSE_LOG_ERR, "load_capng() failed\n");
|
|
+ goto out;
|
|
+ }
|
|
+
|
|
+ if (capng_update(CAPNG_ADD, CAPNG_EFFECTIVE, cap)) {
|
|
+ ret = errno;
|
|
+ fuse_log(FUSE_LOG_ERR, "capng_update(ADD,) failed\n");
|
|
+ goto out;
|
|
+ }
|
|
+
|
|
+ if (capng_apply(CAPNG_SELECT_CAPS)) {
|
|
+ ret = errno;
|
|
+ fuse_log(FUSE_LOG_ERR, "gain:capng_apply() failed\n");
|
|
+ goto out;
|
|
+ }
|
|
+ ret = 0;
|
|
+
|
|
+out:
|
|
+ return ret;
|
|
+}
|
|
+
|
|
static void lo_map_init(struct lo_map *map)
|
|
{
|
|
map->elems = NULL;
|
|
@@ -1577,6 +1662,7 @@ static void lo_write_buf(fuse_req_t req, fuse_ino_t ino,
|
|
(void)ino;
|
|
ssize_t res;
|
|
struct fuse_bufvec out_buf = FUSE_BUFVEC_INIT(fuse_buf_size(in_buf));
|
|
+ bool cap_fsetid_dropped = false;
|
|
|
|
out_buf.buf[0].flags = FUSE_BUF_IS_FD | FUSE_BUF_FD_SEEK;
|
|
out_buf.buf[0].fd = lo_fi_fd(req, fi);
|
|
@@ -1588,12 +1674,31 @@ static void lo_write_buf(fuse_req_t req, fuse_ino_t ino,
|
|
out_buf.buf[0].size, (unsigned long)off);
|
|
}
|
|
|
|
+ /*
|
|
+ * If kill_priv is set, drop CAP_FSETID which should lead to kernel
|
|
+ * clearing setuid/setgid on file.
|
|
+ */
|
|
+ if (fi->kill_priv) {
|
|
+ res = drop_effective_cap("FSETID", &cap_fsetid_dropped);
|
|
+ if (res != 0) {
|
|
+ fuse_reply_err(req, res);
|
|
+ return;
|
|
+ }
|
|
+ }
|
|
+
|
|
res = fuse_buf_copy(&out_buf, in_buf);
|
|
if (res < 0) {
|
|
fuse_reply_err(req, -res);
|
|
} else {
|
|
fuse_reply_write(req, (size_t)res);
|
|
}
|
|
+
|
|
+ if (cap_fsetid_dropped) {
|
|
+ res = gain_effective_cap("FSETID");
|
|
+ if (res) {
|
|
+ fuse_log(FUSE_LOG_ERR, "Failed to gain CAP_FSETID\n");
|
|
+ }
|
|
+ }
|
|
}
|
|
|
|
static void lo_statfs(fuse_req_t req, fuse_ino_t ino)
|
|
--
|
|
1.8.3.1
|
|
|