|
 |
c401cc |
From 7a6f8cea3dbacdd4cd99b82393650cac2b5384e8 Mon Sep 17 00:00:00 2001
|
|
|
c401cc |
Message-Id: <7a6f8cea3dbacdd4cd99b82393650cac2b5384e8@dist-git>
|
|
|
c401cc |
From: "Daniel P. Berrange" <berrange@redhat.com>
|
|
|
c401cc |
Date: Tue, 18 Feb 2014 15:45:36 -0700
|
|
|
c401cc |
Subject: [PATCH] Move check for cgroup devices ACL upfront in LXC hotplug
|
|
|
c401cc |
|
|
|
c401cc |
https://bugzilla.redhat.com/show_bug.cgi?id=1045643
|
|
|
c401cc |
prereq of CVE-2013-6456
|
|
|
c401cc |
|
|
|
c401cc |
The check for whether the cgroup devices ACL is available is
|
|
|
c401cc |
done quite late during LXC hotplug - in fact after the device
|
|
|
c401cc |
node is already created in the container in some cases. Better
|
|
|
c401cc |
to do it upfront so we fail immediately.
|
|
|
c401cc |
|
|
|
c401cc |
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
|
|
|
c401cc |
(cherry picked from commit c3eb12cace868884393d35c23278653634d81c70)
|
|
|
c401cc |
Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
|
|
|
c401cc |
---
|
|
|
c401cc |
src/lxc/lxc_driver.c | 36 ++++++++++++------------------------
|
|
|
c401cc |
1 file changed, 12 insertions(+), 24 deletions(-)
|
|
|
c401cc |
|
|
|
c401cc |
diff --git a/src/lxc/lxc_driver.c b/src/lxc/lxc_driver.c
|
|
|
c401cc |
index 227ea32..33169c8 100644
|
|
|
c401cc |
--- a/src/lxc/lxc_driver.c
|
|
|
c401cc |
+++ b/src/lxc/lxc_driver.c
|
|
|
c401cc |
@@ -3080,6 +3080,12 @@ lxcDomainAttachDeviceDiskLive(virLXCDriverPtr driver,
|
|
|
c401cc |
goto cleanup;
|
|
|
c401cc |
}
|
|
|
c401cc |
|
|
|
c401cc |
+ if (!virCgroupHasController(priv->cgroup, VIR_CGROUP_CONTROLLER_DEVICES)) {
|
|
|
c401cc |
+ virReportError(VIR_ERR_OPERATION_INVALID, "%s",
|
|
|
c401cc |
+ _("devices cgroup isn't mounted"));
|
|
|
c401cc |
+ goto cleanup;
|
|
|
c401cc |
+ }
|
|
|
c401cc |
+
|
|
|
c401cc |
if (def->type != VIR_DOMAIN_DISK_TYPE_BLOCK) {
|
|
|
c401cc |
virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
|
|
|
c401cc |
_("Can't setup disk for non-block device"));
|
|
|
c401cc |
@@ -3147,12 +3153,6 @@ lxcDomainAttachDeviceDiskLive(virLXCDriverPtr driver,
|
|
|
c401cc |
vm->def, def) < 0)
|
|
|
c401cc |
goto cleanup;
|
|
|
c401cc |
|
|
|
c401cc |
- if (!virCgroupHasController(priv->cgroup, VIR_CGROUP_CONTROLLER_DEVICES)) {
|
|
|
c401cc |
- virReportError(VIR_ERR_OPERATION_INVALID, "%s",
|
|
|
c401cc |
- _("devices cgroup isn't mounted"));
|
|
|
c401cc |
- goto cleanup;
|
|
|
c401cc |
- }
|
|
|
c401cc |
-
|
|
|
c401cc |
if (virCgroupAllowDevicePath(priv->cgroup, def->src,
|
|
|
c401cc |
(def->readonly ?
|
|
|
c401cc |
VIR_CGROUP_DEVICE_READ :
|
|
|
c401cc |
@@ -3349,12 +3349,6 @@ lxcDomainAttachDeviceHostdevSubsysUSBLive(virLXCDriverPtr driver,
|
|
|
c401cc |
def->source.subsys.u.usb.device) < 0)
|
|
|
c401cc |
goto cleanup;
|
|
|
c401cc |
|
|
|
c401cc |
- if (!virCgroupHasController(priv->cgroup, VIR_CGROUP_CONTROLLER_DEVICES)) {
|
|
|
c401cc |
- virReportError(VIR_ERR_OPERATION_INVALID, "%s",
|
|
|
c401cc |
- _("devices cgroup isn't mounted"));
|
|
|
c401cc |
- goto cleanup;
|
|
|
c401cc |
- }
|
|
|
c401cc |
-
|
|
|
c401cc |
if (!(usb = virUSBDeviceNew(def->source.subsys.u.usb.bus,
|
|
|
c401cc |
def->source.subsys.u.usb.device, vroot)))
|
|
|
c401cc |
goto cleanup;
|
|
|
c401cc |
@@ -3502,12 +3496,6 @@ lxcDomainAttachDeviceHostdevStorageLive(virLXCDriverPtr driver,
|
|
|
c401cc |
vm->def, def, vroot) < 0)
|
|
|
c401cc |
goto cleanup;
|
|
|
c401cc |
|
|
|
c401cc |
- if (!virCgroupHasController(priv->cgroup, VIR_CGROUP_CONTROLLER_DEVICES)) {
|
|
|
c401cc |
- virReportError(VIR_ERR_OPERATION_INVALID, "%s",
|
|
|
c401cc |
- _("devices cgroup isn't mounted"));
|
|
|
c401cc |
- goto cleanup;
|
|
|
c401cc |
- }
|
|
|
c401cc |
-
|
|
|
c401cc |
if (virCgroupAllowDevicePath(priv->cgroup, def->source.caps.u.storage.block,
|
|
|
c401cc |
VIR_CGROUP_DEVICE_RW |
|
|
|
c401cc |
VIR_CGROUP_DEVICE_MKNOD) != 0) {
|
|
|
c401cc |
@@ -3610,12 +3598,6 @@ lxcDomainAttachDeviceHostdevMiscLive(virLXCDriverPtr driver,
|
|
|
c401cc |
vm->def, def, vroot) < 0)
|
|
|
c401cc |
goto cleanup;
|
|
|
c401cc |
|
|
|
c401cc |
- if (!virCgroupHasController(priv->cgroup, VIR_CGROUP_CONTROLLER_DEVICES)) {
|
|
|
c401cc |
- virReportError(VIR_ERR_OPERATION_INVALID, "%s",
|
|
|
c401cc |
- _("devices cgroup isn't mounted"));
|
|
|
c401cc |
- goto cleanup;
|
|
|
c401cc |
- }
|
|
|
c401cc |
-
|
|
|
c401cc |
if (virCgroupAllowDevicePath(priv->cgroup, def->source.caps.u.misc.chardev,
|
|
|
c401cc |
VIR_CGROUP_DEVICE_RW |
|
|
|
c401cc |
VIR_CGROUP_DEVICE_MKNOD) != 0) {
|
|
|
c401cc |
@@ -3691,6 +3673,12 @@ lxcDomainAttachDeviceHostdevLive(virLXCDriverPtr driver,
|
|
|
c401cc |
return -1;
|
|
|
c401cc |
}
|
|
|
c401cc |
|
|
|
c401cc |
+ if (!virCgroupHasController(priv->cgroup, VIR_CGROUP_CONTROLLER_DEVICES)) {
|
|
|
c401cc |
+ virReportError(VIR_ERR_OPERATION_INVALID, "%s",
|
|
|
c401cc |
+ _("devices cgroup isn't mounted"));
|
|
|
c401cc |
+ return -1;
|
|
|
c401cc |
+ }
|
|
|
c401cc |
+
|
|
|
c401cc |
switch (dev->data.hostdev->mode) {
|
|
|
c401cc |
case VIR_DOMAIN_HOSTDEV_MODE_SUBSYS:
|
|
|
c401cc |
return lxcDomainAttachDeviceHostdevSubsysLive(driver, vm, dev);
|
|
|
c401cc |
--
|
|
|
c401cc |
1.9.0
|
|
|
c401cc |
|