diff options
| author | Greg Kurz | 2017-02-26 23:42:51 +0100 |
|---|---|---|
| committer | Greg Kurz | 2017-02-28 11:21:15 +0100 |
| commit | 72f0d0bf51362011c4d841a89fb8f5cfb16e0bf3 (patch) | |
| tree | f331ff1b1b177f6273edb2f989c3f95159c41e39 /hw/9pfs/9p-xattr.h | |
| parent | 9pfs: local: lsetxattr: don't follow symlinks (diff) | |
| download | qemu-72f0d0bf51362011c4d841a89fb8f5cfb16e0bf3.tar.gz qemu-72f0d0bf51362011c4d841a89fb8f5cfb16e0bf3.tar.xz qemu-72f0d0bf51362011c4d841a89fb8f5cfb16e0bf3.zip | |
9pfs: local: lremovexattr: don't follow symlinks
The local_lremovexattr() callback is vulnerable to symlink attacks because
it calls lremovexattr() which follows symbolic links in all path elements
but the rightmost one.
This patch introduces a helper to emulate the non-existing fremovexattrat()
function: it is implemented with /proc/self/fd which provides a trusted
path that can be safely passed to lremovexattr().
local_lremovexattr() is converted to use this helper and opendir_nofollow().
This partly fixes CVE-2016-9602.
Signed-off-by: Greg Kurz <groug@kaod.org>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Diffstat (limited to 'hw/9pfs/9p-xattr.h')
| -rw-r--r-- | hw/9pfs/9p-xattr.h | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/hw/9pfs/9p-xattr.h b/hw/9pfs/9p-xattr.h index 7558970d85..0d83996575 100644 --- a/hw/9pfs/9p-xattr.h +++ b/hw/9pfs/9p-xattr.h @@ -34,6 +34,8 @@ ssize_t local_getxattr_nofollow(FsContext *ctx, const char *path, ssize_t local_setxattr_nofollow(FsContext *ctx, const char *path, const char *name, void *value, size_t size, int flags); +ssize_t local_removexattr_nofollow(FsContext *ctx, const char *path, + const char *name); extern XattrOperations mapped_user_xattr; extern XattrOperations passthrough_user_xattr; |