7:06 a.m.
This series fixes CVE-2019-10132
It is pushed to master as it was reviewed on the security list
ahead of time.
Daniel P. Berrangé (3):
admin: reject clients unless their UID matches the current UID
locking: restrict sockets to mode 0600
logging: restrict sockets to mode 0600
src/admin/admin_server_dispatch.c | 22 ++++++++++++++++++++++
src/locking/virtlockd-admin.socket.in | 1 +
src/locking/virtlockd.socket.in | 1 +
src/logging/virtlogd-admin.socket.in | 1 +
src/logging/virtlogd.socket.in | 1 +
5 files changed, 26 insertions(+)
--
2.21.0
7:06 a.m.
New subject: [libvirt] [PATCH 1/3] admin: reject clients unless their UID matches the current UID
The admin protocol RPC messages are only intended for use by the user
running the daemon. As such they should not be allowed for any client
UID that does not match the server UID.
Fixes CVE-2019-10132
Reviewed-by: Ján Tomko <jtomko(a)redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com>
---
src/admin/admin_server_dispatch.c | 22 ++++++++++++++++++++++
1 file changed, 22 insertions(+)
diff --git a/src/admin/admin_server_dispatch.c b/src/admin/admin_server_dispatch.c
index 85e693d76c..6e3b99f97d 100644
--- a/src/admin/admin_server_dispatch.c
+++ b/src/admin/admin_server_dispatch.c
@@ -64,6 +64,28 @@ remoteAdmClientNew(virNetServerClientPtr client ATTRIBUTE_UNUSED,
void *opaque)
{
struct daemonAdmClientPrivate *priv;
+ uid_t clientuid;
+ gid_t clientgid;
+ pid_t clientpid;
+ unsigned long long timestamp;
+
+ if (virNetServerClientGetUNIXIdentity(client,
+ &clientuid,
+ &clientgid,
+ &clientpid,
+ ×tamp) < 0)
+ return NULL;
+
+ VIR_DEBUG("New client pid %lld uid %lld",
+ (long long)clientpid,
+ (long long)clientuid);
+
+ if (geteuid() != clientuid) {
+ virReportRestrictedError(_("Disallowing client %lld with uid %lld"),
+ (long long)clientpid,
+ (long long)clientuid);
+ return NULL;
+ }
if (VIR_ALLOC(priv) < 0)
return NULL;
--
2.21.0
7:06 a.m.
New subject: [libvirt] [PATCH 2/3] locking: restrict sockets to mode 0600
The virtlockd daemon's only intended client is the libvirtd daemon. As
such it should never allow clients from other user accounts to connect.
The code already enforces this and drops clients from other UIDs, but
we can get earlier (and thus stronger) protection against DoS by setting
the socket permissions to 0600
Fixes CVE-2019-10132
Reviewed-by: Ján Tomko <jtomko(a)redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com>
---
src/locking/virtlockd-admin.socket.in | 1 +
src/locking/virtlockd.socket.in | 1 +
2 files changed, 2 insertions(+)
diff --git a/src/locking/virtlockd-admin.socket.in
b/src/locking/virtlockd-admin.socket.in
index 2a7500f3d0..f674c492f7 100644
--- a/src/locking/virtlockd-admin.socket.in
+++ b/src/locking/virtlockd-admin.socket.in
@@ -5,6 +5,7 @@ Before=libvirtd.service
[Socket]
ListenStream=@localstatedir@/run/libvirt/virtlockd-admin-sock
Service=virtlockd.service
+SocketMode=0600
[Install]
WantedBy=sockets.target
diff --git a/src/locking/virtlockd.socket.in b/src/locking/virtlockd.socket.in
index 45e0f20235..d701b27516 100644
--- a/src/locking/virtlockd.socket.in
+++ b/src/locking/virtlockd.socket.in
@@ -4,6 +4,7 @@ Before=libvirtd.service
[Socket]
ListenStream=@localstatedir@/run/libvirt/virtlockd-sock
+SocketMode=0600
[Install]
WantedBy=sockets.target
--
2.21.0
7:06 a.m.
New subject: [libvirt] [PATCH 3/3] logging: restrict sockets to mode 0600
The virtlogd daemon's only intended client is the libvirtd daemon. As
such it should never allow clients from other user accounts to connect.
The code already enforces this and drops clients from other UIDs, but
we can get earlier (and thus stronger) protection against DoS by setting
the socket permissions to 0600
Fixes CVE-2019-10132
Reviewed-by: Ján Tomko <jtomko(a)redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com>
---
src/logging/virtlogd-admin.socket.in | 1 +
src/logging/virtlogd.socket.in | 1 +
2 files changed, 2 insertions(+)
diff --git a/src/logging/virtlogd-admin.socket.in b/src/logging/virtlogd-admin.socket.in
index 595e6c4c4b..5c41dfeb7b 100644
--- a/src/logging/virtlogd-admin.socket.in
+++ b/src/logging/virtlogd-admin.socket.in
@@ -5,6 +5,7 @@ Before=libvirtd.service
[Socket]
ListenStream=@localstatedir@/run/libvirt/virtlogd-admin-sock
Service=virtlogd.service
+SocketMode=0600
[Install]
WantedBy=sockets.target
diff --git a/src/logging/virtlogd.socket.in b/src/logging/virtlogd.socket.in
index 22b9360c8d..ae48cdab9a 100644
--- a/src/logging/virtlogd.socket.in
+++ b/src/logging/virtlogd.socket.in
@@ -4,6 +4,7 @@ Before=libvirtd.service
[Socket]
ListenStream=@localstatedir@/run/libvirt/virtlogd-sock
+SocketMode=0600
[Install]
WantedBy=sockets.target
--
2.21.0
1999
days inactive
1999
days old
3 comments
1 participants
participants (1)
-
Daniel P. Berrangé