From 879c28133dfa54b780dffbb29e4dcfc6581f6281 Mon Sep 17 00:00:00 2001 From: "Venkateswararao Jujjuri (JV)" Date: Mon, 14 Jun 2010 13:34:47 -0700 Subject: virtio-9p: Security model for symlink and readlink Mapped mode stores extended attributes in the user space of the extended attributes. Given that the user space extended attributes are available to regular files only, special files are created as regular files on the fileserver and appropriate mode bits are added to the extended attributes. This method presents all special files and symlinks as regular files on the fileserver while they are represented as special files on the guest mount. Implemntation of symlink in mapped security model: A regular file is created and the link target is written to it. readlink() reads it back from the file. On Guest/Client: lrwxrwxrwx 1 root root 6 2010-05-11 12:20 asymlink -> afile On Host/Fileserver: -rw-------. 1 root root 6 2010-05-11 09:20 asymlink afile Under passthrough model, it just calls underlying symlink() readlink() system calls are used. Under both security models, client user credentials are changed after the filesystem objec creation. Signed-off-by: Venkateswararao Jujjuri Signed-off-by: Anthony Liguori --- hw/file-op-9p.h | 2 +- hw/virtio-9p-local.c | 75 +++++++++++++++++++++++++++++++++++++++++++++++----- hw/virtio-9p.c | 13 ++++++--- 3 files changed, 79 insertions(+), 11 deletions(-) diff --git a/hw/file-op-9p.h b/hw/file-op-9p.h index 12223dec20..0808630fe4 100644 --- a/hw/file-op-9p.h +++ b/hw/file-op-9p.h @@ -55,7 +55,7 @@ typedef struct FileOperations int (*mksock)(FsContext *, const char *); int (*utime)(FsContext *, const char *, const struct utimbuf *); int (*remove)(FsContext *, const char *); - int (*symlink)(FsContext *, const char *, const char *); + int (*symlink)(FsContext *, const char *, const char *, FsCred *); int (*link)(FsContext *, const char *, const char *); int (*setuid)(FsContext *, uid_t); int (*close)(FsContext *, int); diff --git a/hw/virtio-9p-local.c b/hw/virtio-9p-local.c index e99eff9639..711f2b5ca1 100644 --- a/hw/virtio-9p-local.c +++ b/hw/virtio-9p-local.c @@ -107,10 +107,25 @@ static int local_post_create_passthrough(FsContext *fs_ctx, const char *path, return 0; } -static ssize_t local_readlink(FsContext *ctx, const char *path, - char *buf, size_t bufsz) +static ssize_t local_readlink(FsContext *fs_ctx, const char *path, + char *buf, size_t bufsz) { - return readlink(rpath(ctx, path), buf, bufsz); + ssize_t tsize = -1; + if (fs_ctx->fs_sm == SM_MAPPED) { + int fd; + fd = open(rpath(fs_ctx, path), O_RDONLY); + if (fd == -1) { + return -1; + } + do { + tsize = read(fd, (void *)buf, bufsz); + } while (tsize == -1 && errno == EINTR); + close(fd); + return tsize; + } else if (fs_ctx->fs_sm == SM_PASSTHROUGH) { + tsize = readlink(rpath(fs_ctx, path), buf, bufsz); + } + return tsize; } static int local_close(FsContext *ctx, int fd) @@ -314,10 +329,58 @@ err_end: } -static int local_symlink(FsContext *ctx, const char *oldpath, - const char *newpath) +static int local_symlink(FsContext *fs_ctx, const char *oldpath, + const char *newpath, FsCred *credp) { - return symlink(oldpath, rpath(ctx, newpath)); + int err = -1; + int serrno = 0; + + /* Determine the security model */ + if (fs_ctx->fs_sm == SM_MAPPED) { + int fd; + ssize_t oldpath_size, write_size; + fd = open(rpath(fs_ctx, newpath), O_CREAT|O_EXCL|O_RDWR, + SM_LOCAL_MODE_BITS); + if (fd == -1) { + return fd; + } + /* Write the oldpath (target) to the file. */ + oldpath_size = strlen(oldpath) + 1; + do { + write_size = write(fd, (void *)oldpath, oldpath_size); + } while (write_size == -1 && errno == EINTR); + + if (write_size != oldpath_size) { + serrno = errno; + close(fd); + err = -1; + goto err_end; + } + close(fd); + /* Set cleint credentials in symlink's xattr */ + credp->fc_mode = credp->fc_mode|S_IFLNK; + err = local_set_xattr(rpath(fs_ctx, newpath), credp); + if (err == -1) { + serrno = errno; + goto err_end; + } + } else if (fs_ctx->fs_sm == SM_PASSTHROUGH) { + err = symlink(oldpath, rpath(fs_ctx, newpath)); + if (err) { + return err; + } + err = lchown(rpath(fs_ctx, newpath), credp->fc_uid, credp->fc_gid); + if (err == -1) { + serrno = errno; + goto err_end; + } + } + return err; + +err_end: + remove(rpath(fs_ctx, newpath)); + errno = serrno; + return err; } static int local_link(FsContext *ctx, const char *oldpath, const char *newpath) diff --git a/hw/virtio-9p.c b/hw/virtio-9p.c index 005f725a47..1a25e96955 100644 --- a/hw/virtio-9p.c +++ b/hw/virtio-9p.c @@ -199,10 +199,15 @@ static int v9fs_do_open2(V9fsState *s, V9fsCreateState *vs) return s->ops->open2(&s->ctx, vs->fullname.data, flags, &cred); } -static int v9fs_do_symlink(V9fsState *s, V9fsString *oldpath, - V9fsString *newpath) +static int v9fs_do_symlink(V9fsState *s, V9fsCreateState *vs) { - return s->ops->symlink(&s->ctx, oldpath->data, newpath->data); + FsCred cred; + cred_init(&cred); + cred.fc_uid = vs->fidp->uid; + cred.fc_mode = vs->perm | 0777; + + return s->ops->symlink(&s->ctx, vs->extension.data, vs->fullname.data, + &cred); } static int v9fs_do_link(V9fsState *s, V9fsString *oldpath, V9fsString *newpath) @@ -1785,7 +1790,7 @@ static void v9fs_create_post_lstat(V9fsState *s, V9fsCreateState *vs, int err) err = v9fs_do_mkdir(s, vs); v9fs_create_post_mkdir(s, vs, err); } else if (vs->perm & P9_STAT_MODE_SYMLINK) { - err = v9fs_do_symlink(s, &vs->extension, &vs->fullname); + err = v9fs_do_symlink(s, vs); v9fs_create_post_perms(s, vs, err); } else if (vs->perm & P9_STAT_MODE_LINK) { int32_t nfid = atoi(vs->extension.data); -- cgit v1.2.3