176 lines
5.2 KiB
Diff
176 lines
5.2 KiB
Diff
From f62613d8058bcb60b26727d980a37537103b0033 Mon Sep 17 00:00:00 2001
|
|
From: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
|
|
Date: Mon, 27 Jan 2020 19:01:32 +0100
|
|
Subject: [PATCH 061/116] virtiofsd: cap-ng helpers
|
|
MIME-Version: 1.0
|
|
Content-Type: text/plain; charset=UTF-8
|
|
Content-Transfer-Encoding: 8bit
|
|
|
|
RH-Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
|
|
Message-id: <20200127190227.40942-58-dgilbert@redhat.com>
|
|
Patchwork-id: 93512
|
|
O-Subject: [RHEL-AV-8.2 qemu-kvm PATCH 057/112] virtiofsd: cap-ng helpers
|
|
Bugzilla: 1694164
|
|
RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
|
|
RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
|
|
RH-Acked-by: Sergio Lopez Pascual <slp@redhat.com>
|
|
|
|
From: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
|
|
|
|
libcap-ng reads /proc during capng_get_caps_process, and virtiofsd's
|
|
sandboxing doesn't have /proc mounted; thus we have to do the
|
|
caps read before we sandbox it and save/restore the state.
|
|
|
|
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
|
|
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
|
|
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
|
|
(cherry picked from commit 2405f3c0d19eb4d516a88aa4e5c54e5f9c6bbea3)
|
|
Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
|
|
---
|
|
Makefile | 4 +--
|
|
tools/virtiofsd/passthrough_ll.c | 72 ++++++++++++++++++++++++++++++++++++++++
|
|
2 files changed, 74 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/Makefile b/Makefile
|
|
index 6879a06..ff05c30 100644
|
|
--- a/Makefile
|
|
+++ b/Makefile
|
|
@@ -330,7 +330,7 @@ endif
|
|
endif
|
|
endif
|
|
|
|
-ifeq ($(CONFIG_LINUX)$(CONFIG_SECCOMP),yy)
|
|
+ifeq ($(CONFIG_LINUX)$(CONFIG_SECCOMP)$(CONFIG_LIBCAP_NG),yyy)
|
|
HELPERS-y += virtiofsd$(EXESUF)
|
|
vhost-user-json-y += tools/virtiofsd/50-qemu-virtiofsd.json
|
|
endif
|
|
@@ -682,7 +682,7 @@ rdmacm-mux$(EXESUF): $(rdmacm-mux-obj-y) $(COMMON_LDADDS)
|
|
$(call LINK, $^)
|
|
|
|
# relies on Linux-specific syscalls
|
|
-ifeq ($(CONFIG_LINUX)$(CONFIG_SECCOMP),yy)
|
|
+ifeq ($(CONFIG_LINUX)$(CONFIG_SECCOMP)$(CONFIG_LIBCAP_NG),yyy)
|
|
virtiofsd$(EXESUF): $(virtiofsd-obj-y) libvhost-user.a $(COMMON_LDADDS)
|
|
$(call LINK, $^)
|
|
endif
|
|
diff --git a/tools/virtiofsd/passthrough_ll.c b/tools/virtiofsd/passthrough_ll.c
|
|
index bd8925b..97e7c75 100644
|
|
--- a/tools/virtiofsd/passthrough_ll.c
|
|
+++ b/tools/virtiofsd/passthrough_ll.c
|
|
@@ -39,6 +39,7 @@
|
|
#include "fuse_virtio.h"
|
|
#include "fuse_lowlevel.h"
|
|
#include <assert.h>
|
|
+#include <cap-ng.h>
|
|
#include <dirent.h>
|
|
#include <errno.h>
|
|
#include <inttypes.h>
|
|
@@ -139,6 +140,13 @@ static const struct fuse_opt lo_opts[] = {
|
|
|
|
static void unref_inode(struct lo_data *lo, struct lo_inode *inode, uint64_t n);
|
|
|
|
+static struct {
|
|
+ pthread_mutex_t mutex;
|
|
+ void *saved;
|
|
+} cap;
|
|
+/* That we loaded cap-ng in the current thread from the saved */
|
|
+static __thread bool cap_loaded = 0;
|
|
+
|
|
static struct lo_inode *lo_find(struct lo_data *lo, struct stat *st);
|
|
|
|
static int is_dot_or_dotdot(const char *name)
|
|
@@ -162,6 +170,37 @@ static struct lo_data *lo_data(fuse_req_t req)
|
|
return (struct lo_data *)fuse_req_userdata(req);
|
|
}
|
|
|
|
+/*
|
|
+ * Load capng's state from our saved state if the current thread
|
|
+ * hadn't previously been loaded.
|
|
+ * returns 0 on success
|
|
+ */
|
|
+static int load_capng(void)
|
|
+{
|
|
+ if (!cap_loaded) {
|
|
+ pthread_mutex_lock(&cap.mutex);
|
|
+ capng_restore_state(&cap.saved);
|
|
+ /*
|
|
+ * restore_state free's the saved copy
|
|
+ * so make another.
|
|
+ */
|
|
+ cap.saved = capng_save_state();
|
|
+ if (!cap.saved) {
|
|
+ fuse_log(FUSE_LOG_ERR, "capng_save_state (thread)\n");
|
|
+ return -EINVAL;
|
|
+ }
|
|
+ pthread_mutex_unlock(&cap.mutex);
|
|
+
|
|
+ /*
|
|
+ * We want to use the loaded state for our pid,
|
|
+ * not the original
|
|
+ */
|
|
+ capng_setpid(syscall(SYS_gettid));
|
|
+ cap_loaded = true;
|
|
+ }
|
|
+ return 0;
|
|
+}
|
|
+
|
|
static void lo_map_init(struct lo_map *map)
|
|
{
|
|
map->elems = NULL;
|
|
@@ -2024,6 +2063,35 @@ static void setup_namespaces(struct lo_data *lo, struct fuse_session *se)
|
|
}
|
|
|
|
/*
|
|
+ * Capture the capability state, we'll need to restore this for individual
|
|
+ * threads later; see load_capng.
|
|
+ */
|
|
+static void setup_capng(void)
|
|
+{
|
|
+ /* Note this accesses /proc so has to happen before the sandbox */
|
|
+ if (capng_get_caps_process()) {
|
|
+ fuse_log(FUSE_LOG_ERR, "capng_get_caps_process\n");
|
|
+ exit(1);
|
|
+ }
|
|
+ pthread_mutex_init(&cap.mutex, NULL);
|
|
+ pthread_mutex_lock(&cap.mutex);
|
|
+ cap.saved = capng_save_state();
|
|
+ if (!cap.saved) {
|
|
+ fuse_log(FUSE_LOG_ERR, "capng_save_state\n");
|
|
+ exit(1);
|
|
+ }
|
|
+ pthread_mutex_unlock(&cap.mutex);
|
|
+}
|
|
+
|
|
+static void cleanup_capng(void)
|
|
+{
|
|
+ free(cap.saved);
|
|
+ cap.saved = NULL;
|
|
+ pthread_mutex_destroy(&cap.mutex);
|
|
+}
|
|
+
|
|
+
|
|
+/*
|
|
* Make the source directory our root so symlinks cannot escape and no other
|
|
* files are accessible. Assumes unshare(CLONE_NEWNS) was already called.
|
|
*/
|
|
@@ -2216,12 +2284,16 @@ int main(int argc, char *argv[])
|
|
|
|
fuse_daemonize(opts.foreground);
|
|
|
|
+ /* Must be before sandbox since it wants /proc */
|
|
+ setup_capng();
|
|
+
|
|
setup_sandbox(&lo, se);
|
|
|
|
/* Block until ctrl+c or fusermount -u */
|
|
ret = virtio_loop(se);
|
|
|
|
fuse_session_unmount(se);
|
|
+ cleanup_capng();
|
|
err_out3:
|
|
fuse_remove_signal_handlers(se);
|
|
err_out2:
|
|
--
|
|
1.8.3.1
|
|
|