Re: [libvirt] [PATCH] move ebiptables script out of /tmp

On Wed, 2010-06-16 at 15:11 -0400, Stefan Berger wrote: The main reason is to not use /tmp when you don't have to. I consider this good defensive programming. Regarding your question on subverting libvirt: Assume that someone has strictly confined libvirtd with a Mandatory Access Control (MAC) system. libvirtd would presumably then be allowed to execute only those commands allowed by the MAC (a very small subset of all commands on the system). If the MAC also allows execution of /tmp/virtd* (which it needs to for proper ebiptables functionality in 0.8.0 and higher without my suggested change), then this weakens the MAC protection because if there is a vulnerability discovered in libvirt that allows a non-root local attacker to execute arbitrary code, the attacker can write a script called /tmp/virtd.gotcha and have libvirt execute that as root. If the file is moved to /var/lib/libvirt (or wherever) as I suggested, then the MAC would allow execute permissions on the files /var/lib/libvirt/virtd*, not files in /tmp. The non-root user cannot circumvent the MAC in this manner even if the user has an exploit against libvirt because the MAC doesn't allow execute of files in an area that the user has write access to. Obviously, some of this is dependent on the MAC policy in place. Like I said, I don't consider this a vulnerability in and of itself because of the current proper use of mkstemp(), but since the file doesn't seem to need to be shared, why have it in a directory that is world-writable? -- Jamie Strandboge | http://www.canonical.com