diff options
| author | Greg Kurz <groug@kaod.org> | 2017-02-26 23:42:18 +0100 |
|---|---|---|
| committer | Greg Kurz <groug@kaod.org> | 2017-02-28 11:21:15 +0100 |
| commit | 996a0d76d7e756e4023ef79bc37bfe629b9eaca7 (patch) | |
| tree | 78bbc93d08e0142f0a845fd549598cffe58f4302 /hw/9pfs/9p-local.h | |
| parent | 0e35a3782948c6154d7fafe9a02a86bc130199c7 (diff) | |
9pfs: local: open/opendir: don't follow symlinks
The local_open() and local_opendir() callbacks are vulnerable to symlink
attacks because they call:
(1) open(O_NOFOLLOW) which follows symbolic links in all path elements but
the rightmost one
(2) opendir() which follows symbolic links in all path elements
This patch converts both callbacks to use new helpers based on
openat_nofollow() to only open files and directories if they are
below the virtfs shared folder
This partly fixes CVE-2016-9602.
Signed-off-by: Greg Kurz <groug@kaod.org>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Diffstat (limited to 'hw/9pfs/9p-local.h')
| -rw-r--r-- | hw/9pfs/9p-local.h | 20 |
1 files changed, 20 insertions, 0 deletions
diff --git a/hw/9pfs/9p-local.h b/hw/9pfs/9p-local.h new file mode 100644 index 0000000000..32c72749d9 --- /dev/null +++ b/hw/9pfs/9p-local.h @@ -0,0 +1,20 @@ +/* + * 9p local backend utilities + * + * Copyright IBM, Corp. 2017 + * + * Authors: + * Greg Kurz <groug@kaod.org> + * + * This work is licensed under the terms of the GNU GPL, version 2 or later. + * See the COPYING file in the top-level directory. + */ + +#ifndef QEMU_9P_LOCAL_H +#define QEMU_9P_LOCAL_H + +int local_open_nofollow(FsContext *fs_ctx, const char *path, int flags, + mode_t mode); +int local_opendir_nofollow(FsContext *fs_ctx, const char *path); + +#endif |