|
 |
df3a49 |
From 5ed86f689f011c36e8008c30dc3dfe89bfbf280a Mon Sep 17 00:00:00 2001
|
|
|
df3a49 |
Message-Id: <5ed86f689f011c36e8008c30dc3dfe89bfbf280a@dist-git>
|
|
|
df3a49 |
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
|
|
|
df3a49 |
Date: Wed, 15 May 2019 21:40:56 +0100
|
|
|
df3a49 |
Subject: [PATCH] admin: reject clients unless their UID matches the current
|
|
|
df3a49 |
UID
|
|
|
df3a49 |
MIME-Version: 1.0
|
|
|
df3a49 |
Content-Type: text/plain; charset=UTF-8
|
|
|
df3a49 |
Content-Transfer-Encoding: 8bit
|
|
|
df3a49 |
|
|
|
df3a49 |
The admin protocol RPC messages are only intended for use by the user
|
|
|
df3a49 |
running the daemon. As such they should not be allowed for any client
|
|
|
df3a49 |
UID that does not match the server UID.
|
|
|
df3a49 |
|
|
|
df3a49 |
Fixes CVE-2019-10132
|
|
|
df3a49 |
|
|
|
df3a49 |
Reviewed-by: Ján Tomko <jtomko@redhat.com>
|
|
|
df3a49 |
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
|
|
|
df3a49 |
(cherry picked from a private commit)
|
|
|
df3a49 |
Reviewed-by: Jiri Denemark <jdenemar@redhat.com>
|
|
|
df3a49 |
Message-Id: <20190515204058.28077-2-berrange@redhat.com>
|
|
|
df3a49 |
---
|
|
|
df3a49 |
src/admin/admin_server_dispatch.c | 22 ++++++++++++++++++++++
|
|
|
df3a49 |
1 file changed, 22 insertions(+)
|
|
|
df3a49 |
|
|
|
df3a49 |
diff --git a/src/admin/admin_server_dispatch.c b/src/admin/admin_server_dispatch.c
|
|
|
df3a49 |
index b78ff902c0..9f25813ae3 100644
|
|
|
df3a49 |
--- a/src/admin/admin_server_dispatch.c
|
|
|
df3a49 |
+++ b/src/admin/admin_server_dispatch.c
|
|
|
df3a49 |
@@ -66,6 +66,28 @@ remoteAdmClientNew(virNetServerClientPtr client ATTRIBUTE_UNUSED,
|
|
|
df3a49 |
void *opaque)
|
|
|
df3a49 |
{
|
|
|
df3a49 |
struct daemonAdmClientPrivate *priv;
|
|
|
df3a49 |
+ uid_t clientuid;
|
|
|
df3a49 |
+ gid_t clientgid;
|
|
|
df3a49 |
+ pid_t clientpid;
|
|
|
df3a49 |
+ unsigned long long timestamp;
|
|
|
df3a49 |
+
|
|
|
df3a49 |
+ if (virNetServerClientGetUNIXIdentity(client,
|
|
|
df3a49 |
+ &clientuid,
|
|
|
df3a49 |
+ &clientgid,
|
|
|
df3a49 |
+ &clientpid,
|
|
|
df3a49 |
+ ×tamp) < 0)
|
|
|
df3a49 |
+ return NULL;
|
|
|
df3a49 |
+
|
|
|
df3a49 |
+ VIR_DEBUG("New client pid %lld uid %lld",
|
|
|
df3a49 |
+ (long long)clientpid,
|
|
|
df3a49 |
+ (long long)clientuid);
|
|
|
df3a49 |
+
|
|
|
df3a49 |
+ if (geteuid() != clientuid) {
|
|
|
df3a49 |
+ virReportRestrictedError(_("Disallowing client %lld with uid %lld"),
|
|
|
df3a49 |
+ (long long)clientpid,
|
|
|
df3a49 |
+ (long long)clientuid);
|
|
|
df3a49 |
+ return NULL;
|
|
|
df3a49 |
+ }
|
|
|
df3a49 |
|
|
|
df3a49 |
if (VIR_ALLOC(priv) < 0)
|
|
|
df3a49 |
return NULL;
|
|
|
df3a49 |
--
|
|
|
df3a49 |
2.21.0
|
|
|
df3a49 |
|