[libvirt] [PATCH] event: move event filtering to daemon (regression fix)
Commit f9f56340 for CVE-2014-0028 almost had the right idea - we need to check the ACL rules to filter which events to send. But it overlooked one thing: the event dispatch queue is running in the main loop thread, and therefore does not normally have a current virIdentityPtr. But filter checks can be based on current identity, so when libvirtd.conf contains access_drivers=["polkit"], we ended up rejecting access for EVERY event due to failure to look up the current identity, even if it should have been allowed. Furthermore, even for events that are triggered by API calls, it is important to remember that the point of events is that they can be copied across multiple connections, which may have separate identities and permissions. So even if events were dispatched from a context where we have an identity, we must change to the correct identity of the connection that will be receiving the event, rather than basing a decision on the context that triggered the event, when deciding whether to filter an event to a particular connection. If there were an easy way to get from virConnectPtr to the appropriate virIdentityPtr, then object_event.c could adjust the identity prior to checking whether to dispatch an event. But setting up that back-reference is a bit invasive. Instead, it is easier to delay the filtering check until lower down the stack, at the point where we have direct access to the RPC client object that owns an identity. As such, this patch ends up reverting a large portion of the framework of commit f9f56340. We also have to teach 'make check' to special-case the fact that the event registration filtering is done at the point of dispatch, rather than the point of registration. Note that even though we don't actually use virConnectDomainEventRegisterCheckACL (because the RegisterAny variant is sufficient), we still generate the function for the purposes of documenting that the filtering takes place. Also note that I did not entirely delete the notion of a filter from object_event.c; I still plan on using that for my upcoming patch series for qemu monitor events in libvirt-qemu.so. In other words, while this patch changes ACL filtering to live in remote.c and therefore we have no current client of the filtering in object_event.c, the notion of filtering in object_event.c is still useful down the road. * src/check-aclrules.pl: Exempt event registration from having to pass checkACL filter down call stack. * daemon/remote.c (remoteRelayDomainEventCheckACL) (remoteRelayNetworkEventCheckACL): New functions. (remoteRelay*Event*): Use new functions. * src/conf/domain_event.h (virDomainEventStateRegister) (virDomainEventStateRegisterID): Drop unused parameter. * src/conf/network_event.h (virNetworkEventStateRegisterID): Likewise. * src/conf/domain_event.c (virDomainEventFilter): Delete unused function. * src/conf/network_event.c (virNetworkEventFilter): Likewise. * src/libxl/libxl_driver.c: Adjust caller. * src/lxc/lxc_driver.c: Likewise. * src/network/bridge_driver.c: Likewise. * src/qemu/qemu_driver.c: Likewise. * src/remote/remote_driver.c: Likewise. * src/test/test_driver.c: Likewise. * src/uml/uml_driver.c: Likewise. * src/vbox/vbox_tmpl.c: Likewise. * src/xen/xen_driver.c: Likewise. Signed-off-by: Eric Blake <eblake@redhat.com> --- daemon/remote.c | 257 ++++++++++++++++++++++++++++---------------- src/check-aclrules.pl | 7 +- src/conf/domain_event.c | 35 +----- src/conf/domain_event.h | 8 +- src/conf/network_event.c | 31 +----- src/conf/network_event.h | 6 +- src/libxl/libxl_driver.c | 2 - src/lxc/lxc_driver.c | 2 - src/network/bridge_driver.c | 1 - src/qemu/qemu_driver.c | 2 - src/remote/remote_driver.c | 4 +- src/test/test_driver.c | 6 +- src/uml/uml_driver.c | 2 - src/vbox/vbox_tmpl.c | 4 +- src/xen/xen_driver.c | 2 - 15 files changed, 188 insertions(+), 181 deletions(-) diff --git a/daemon/remote.c b/daemon/remote.c index d2aafbe..5baf0b6 100644 --- a/daemon/remote.c +++ b/daemon/remote.c @@ -50,6 +50,9 @@ #include "lxc_protocol.h" #include "virstring.h" #include "object_event.h" +#include "domain_conf.h" +#include "network_conf.h" +#include "viraccessapicheck.h" #define VIR_FROM_THIS VIR_FROM_RPC @@ -127,16 +130,72 @@ remoteEventCallbackFree(void *opaque) VIR_FREE(opaque); } -static int remoteRelayDomainEventLifecycle(virConnectPtr conn ATTRIBUTE_UNUSED, - virDomainPtr dom, - int event, - int detail, - void *opaque) + +static bool +remoteRelayDomainEventCheckACL(virNetServerClientPtr client, + virConnectPtr conn, virDomainPtr dom) +{ + virDomainDef def; + virIdentityPtr identity = NULL; + bool ret = false; + + /* For now, we just create a virDomainDef with enough contents to + * satisfy what viraccessdriverpolkit.c references. This is a bit + * fragile, but I don't know of anything better. */ + def.name = dom->name; + memcpy(def.uuid, dom->uuid, VIR_UUID_BUFLEN); + + if (!(identity = virNetServerClientGetIdentity(client))) + goto cleanup; + if (virIdentitySetCurrent(identity) < 0) + goto cleanup; + ret = virConnectDomainEventRegisterAnyCheckACL(conn, &def); + +cleanup: + ignore_value(virIdentitySetCurrent(NULL)); + virObjectUnref(identity); + return ret; +} + + +static bool +remoteRelayNetworkEventCheckACL(virNetServerClientPtr client, + virConnectPtr conn, virNetworkPtr net) +{ + virNetworkDef def; + virIdentityPtr identity = NULL; + bool ret = false; + + /* For now, we just create a virNetworkDef with enough contents to + * satisfy what viraccessdriverpolkit.c references. This is a bit + * fragile, but I don't know of anything better. */ + def.name = net->name; + memcpy(def.uuid, net->uuid, VIR_UUID_BUFLEN); + + if (!(identity = virNetServerClientGetIdentity(client))) + goto cleanup; + if (virIdentitySetCurrent(identity) < 0) + goto cleanup; + ret = virConnectNetworkEventRegisterAnyCheckACL(conn, &def); + +cleanup: + ignore_value(virIdentitySetCurrent(NULL)); + virObjectUnref(identity); + return ret; +} + + +static int +remoteRelayDomainEventLifecycle(virConnectPtr conn, + virDomainPtr dom, + int event, + int detail, + void *opaque) { virNetServerClientPtr client = opaque; remote_domain_event_lifecycle_msg data; - if (!client) + if (!client || !remoteRelayDomainEventCheckACL(client, conn, dom)) return -1; VIR_DEBUG("Relaying domain lifecycle event %d %d", event, detail); @@ -154,14 +213,15 @@ static int remoteRelayDomainEventLifecycle(virConnectPtr conn ATTRIBUTE_UNUSED, return 0; } -static int remoteRelayDomainEventReboot(virConnectPtr conn ATTRIBUTE_UNUSED, - virDomainPtr dom, - void *opaque) +static int +remoteRelayDomainEventReboot(virConnectPtr conn, + virDomainPtr dom, + void *opaque) { virNetServerClientPtr client = opaque; remote_domain_event_reboot_msg data; - if (!client) + if (!client || !remoteRelayDomainEventCheckACL(client, conn, dom)) return -1; VIR_DEBUG("Relaying domain reboot event %s %d", dom->name, dom->id); @@ -178,15 +238,16 @@ static int remoteRelayDomainEventReboot(virConnectPtr conn ATTRIBUTE_UNUSED, } -static int remoteRelayDomainEventRTCChange(virConnectPtr conn ATTRIBUTE_UNUSED, - virDomainPtr dom, - long long offset, - void *opaque) +static int +remoteRelayDomainEventRTCChange(virConnectPtr conn, + virDomainPtr dom, + long long offset, + void *opaque) { virNetServerClientPtr client = opaque; remote_domain_event_rtc_change_msg data; - if (!client) + if (!client || !remoteRelayDomainEventCheckACL(client, conn, dom)) return -1; VIR_DEBUG("Relaying domain rtc change event %s %d %lld", dom->name, dom->id, offset); @@ -204,15 +265,16 @@ static int remoteRelayDomainEventRTCChange(virConnectPtr conn ATTRIBUTE_UNUSED, } -static int remoteRelayDomainEventWatchdog(virConnectPtr conn ATTRIBUTE_UNUSED, - virDomainPtr dom, - int action, - void *opaque) +static int +remoteRelayDomainEventWatchdog(virConnectPtr conn, + virDomainPtr dom, + int action, + void *opaque) { virNetServerClientPtr client = opaque; remote_domain_event_watchdog_msg data; - if (!client) + if (!client || !remoteRelayDomainEventCheckACL(client, conn, dom)) return -1; VIR_DEBUG("Relaying domain watchdog event %s %d %d", dom->name, dom->id, action); @@ -230,17 +292,18 @@ static int remoteRelayDomainEventWatchdog(virConnectPtr conn ATTRIBUTE_UNUSED, } -static int remoteRelayDomainEventIOError(virConnectPtr conn ATTRIBUTE_UNUSED, - virDomainPtr dom, - const char *srcPath, - const char *devAlias, - int action, - void *opaque) +static int +remoteRelayDomainEventIOError(virConnectPtr conn, + virDomainPtr dom, + const char *srcPath, + const char *devAlias, + int action, + void *opaque) { virNetServerClientPtr client = opaque; remote_domain_event_io_error_msg data; - if (!client) + if (!client || !remoteRelayDomainEventCheckACL(client, conn, dom)) return -1; VIR_DEBUG("Relaying domain io error %s %d %s %s %d", dom->name, dom->id, srcPath, devAlias, action); @@ -265,18 +328,19 @@ error: } -static int remoteRelayDomainEventIOErrorReason(virConnectPtr conn ATTRIBUTE_UNUSED, - virDomainPtr dom, - const char *srcPath, - const char *devAlias, - int action, - const char *reason, - void *opaque) +static int +remoteRelayDomainEventIOErrorReason(virConnectPtr conn, + virDomainPtr dom, + const char *srcPath, + const char *devAlias, + int action, + const char *reason, + void *opaque) { virNetServerClientPtr client = opaque; remote_domain_event_io_error_reason_msg data; - if (!client) + if (!client || !remoteRelayDomainEventCheckACL(client, conn, dom)) return -1; VIR_DEBUG("Relaying domain io error %s %d %s %s %d %s", @@ -306,20 +370,21 @@ error: } -static int remoteRelayDomainEventGraphics(virConnectPtr conn ATTRIBUTE_UNUSED, - virDomainPtr dom, - int phase, - virDomainEventGraphicsAddressPtr local, - virDomainEventGraphicsAddressPtr remote, - const char *authScheme, - virDomainEventGraphicsSubjectPtr subject, - void *opaque) +static int +remoteRelayDomainEventGraphics(virConnectPtr conn, + virDomainPtr dom, + int phase, + virDomainEventGraphicsAddressPtr local, + virDomainEventGraphicsAddressPtr remote, + const char *authScheme, + virDomainEventGraphicsSubjectPtr subject, + void *opaque) { virNetServerClientPtr client = opaque; remote_domain_event_graphics_msg data; size_t i; - if (!client) + if (!client || !remoteRelayDomainEventCheckACL(client, conn, dom)) return -1; VIR_DEBUG("Relaying domain graphics event %s %d %d - %d %s %s - %d %s %s - %s", dom->name, dom->id, phase, @@ -377,17 +442,18 @@ error: return -1; } -static int remoteRelayDomainEventBlockJob(virConnectPtr conn ATTRIBUTE_UNUSED, - virDomainPtr dom, - const char *path, - int type, - int status, - void *opaque) +static int +remoteRelayDomainEventBlockJob(virConnectPtr conn, + virDomainPtr dom, + const char *path, + int type, + int status, + void *opaque) { virNetServerClientPtr client = opaque; remote_domain_event_block_job_msg data; - if (!client) + if (!client || !remoteRelayDomainEventCheckACL(client, conn, dom)) return -1; VIR_DEBUG("Relaying domain block job event %s %d %s %i, %i", @@ -412,14 +478,15 @@ error: } -static int remoteRelayDomainEventControlError(virConnectPtr conn ATTRIBUTE_UNUSED, - virDomainPtr dom, - void *opaque) +static int +remoteRelayDomainEventControlError(virConnectPtr conn, + virDomainPtr dom, + void *opaque) { virNetServerClientPtr client = opaque; remote_domain_event_control_error_msg data; - if (!client) + if (!client || !remoteRelayDomainEventCheckACL(client, conn, dom)) return -1; VIR_DEBUG("Relaying domain control error %s %d", dom->name, dom->id); @@ -436,19 +503,20 @@ static int remoteRelayDomainEventControlError(virConnectPtr conn ATTRIBUTE_UNUSE } -static int remoteRelayDomainEventDiskChange(virConnectPtr conn ATTRIBUTE_UNUSED, - virDomainPtr dom, - const char *oldSrcPath, - const char *newSrcPath, - const char *devAlias, - int reason, - void *opaque) +static int +remoteRelayDomainEventDiskChange(virConnectPtr conn, + virDomainPtr dom, + const char *oldSrcPath, + const char *newSrcPath, + const char *devAlias, + int reason, + void *opaque) { virNetServerClientPtr client = opaque; remote_domain_event_disk_change_msg data; char **oldSrcPath_p = NULL, **newSrcPath_p = NULL; - if (!client) + if (!client || !remoteRelayDomainEventCheckACL(client, conn, dom)) return -1; VIR_DEBUG("Relaying domain %s %d disk change %s %s %s %d", @@ -487,15 +555,17 @@ error: } -static int remoteRelayDomainEventTrayChange(virConnectPtr conn ATTRIBUTE_UNUSED, - virDomainPtr dom, - const char *devAlias, - int reason, - void *opaque) { +static int +remoteRelayDomainEventTrayChange(virConnectPtr conn, + virDomainPtr dom, + const char *devAlias, + int reason, + void *opaque) +{ virNetServerClientPtr client = opaque; remote_domain_event_tray_change_msg data; - if (!client) + if (!client || !remoteRelayDomainEventCheckACL(client, conn, dom)) return -1; VIR_DEBUG("Relaying domain %s %d tray change devAlias: %s reason: %d", @@ -517,14 +587,16 @@ static int remoteRelayDomainEventTrayChange(virConnectPtr conn ATTRIBUTE_UNUSED, return 0; } -static int remoteRelayDomainEventPMWakeup(virConnectPtr conn ATTRIBUTE_UNUSED, - virDomainPtr dom, - int reason ATTRIBUTE_UNUSED, - void *opaque) { +static int +remoteRelayDomainEventPMWakeup(virConnectPtr conn, + virDomainPtr dom, + int reason ATTRIBUTE_UNUSED, + void *opaque) +{ virNetServerClientPtr client = opaque; remote_domain_event_pmwakeup_msg data; - if (!client) + if (!client || !remoteRelayDomainEventCheckACL(client, conn, dom)) return -1; VIR_DEBUG("Relaying domain %s %d system pmwakeup", dom->name, dom->id); @@ -540,14 +612,16 @@ static int remoteRelayDomainEventPMWakeup(virConnectPtr conn ATTRIBUTE_UNUSED, return 0; } -static int remoteRelayDomainEventPMSuspend(virConnectPtr conn ATTRIBUTE_UNUSED, - virDomainPtr dom, - int reason ATTRIBUTE_UNUSED, - void *opaque) { +static int +remoteRelayDomainEventPMSuspend(virConnectPtr conn, + virDomainPtr dom, + int reason ATTRIBUTE_UNUSED, + void *opaque) +{ virNetServerClientPtr client = opaque; remote_domain_event_pmsuspend_msg data; - if (!client) + if (!client || !remoteRelayDomainEventCheckACL(client, conn, dom)) return -1; VIR_DEBUG("Relaying domain %s %d system pmsuspend", dom->name, dom->id); @@ -564,7 +638,7 @@ static int remoteRelayDomainEventPMSuspend(virConnectPtr conn ATTRIBUTE_UNUSED, } static int -remoteRelayDomainEventBalloonChange(virConnectPtr conn ATTRIBUTE_UNUSED, +remoteRelayDomainEventBalloonChange(virConnectPtr conn, virDomainPtr dom, unsigned long long actual, void *opaque) @@ -572,7 +646,7 @@ remoteRelayDomainEventBalloonChange(virConnectPtr conn ATTRIBUTE_UNUSED, virNetServerClientPtr client = opaque; remote_domain_event_balloon_change_msg data; - if (!client) + if (!client || !remoteRelayDomainEventCheckACL(client, conn, dom)) return -1; VIR_DEBUG("Relaying domain balloon change event %s %d %lld", dom->name, dom->id, actual); @@ -590,14 +664,16 @@ remoteRelayDomainEventBalloonChange(virConnectPtr conn ATTRIBUTE_UNUSED, } -static int remoteRelayDomainEventPMSuspendDisk(virConnectPtr conn ATTRIBUTE_UNUSED, - virDomainPtr dom, - int reason ATTRIBUTE_UNUSED, - void *opaque) { +static int +remoteRelayDomainEventPMSuspendDisk(virConnectPtr conn, + virDomainPtr dom, + int reason ATTRIBUTE_UNUSED, + void *opaque) +{ virNetServerClientPtr client = opaque; remote_domain_event_pmsuspend_disk_msg data; - if (!client) + if (!client || !remoteRelayDomainEventCheckACL(client, conn, dom)) return -1; VIR_DEBUG("Relaying domain %s %d system pmsuspend-disk", dom->name, dom->id); @@ -614,7 +690,7 @@ static int remoteRelayDomainEventPMSuspendDisk(virConnectPtr conn ATTRIBUTE_UNUS } static int -remoteRelayDomainEventDeviceRemoved(virConnectPtr conn ATTRIBUTE_UNUSED, +remoteRelayDomainEventDeviceRemoved(virConnectPtr conn, virDomainPtr dom, const char *devAlias, void *opaque) @@ -622,7 +698,7 @@ remoteRelayDomainEventDeviceRemoved(virConnectPtr conn ATTRIBUTE_UNUSED, virNetServerClientPtr client = opaque; remote_domain_event_device_removed_msg data; - if (!client) + if (!client || !remoteRelayDomainEventCheckACL(client, conn, dom)) return -1; VIR_DEBUG("Relaying domain device removed event %s %d %s", @@ -667,7 +743,7 @@ static virConnectDomainEventGenericCallback domainEventCallbacks[] = { verify(ARRAY_CARDINALITY(domainEventCallbacks) == VIR_DOMAIN_EVENT_ID_LAST); static int -remoteRelayNetworkEventLifecycle(virConnectPtr conn ATTRIBUTE_UNUSED, +remoteRelayNetworkEventLifecycle(virConnectPtr conn, virNetworkPtr net, int event, int detail, @@ -676,7 +752,8 @@ remoteRelayNetworkEventLifecycle(virConnectPtr conn ATTRIBUTE_UNUSED, daemonClientEventCallbackPtr callback = opaque; remote_network_event_lifecycle_msg data; - if (callback->callbackID < 0) + if (callback->callbackID < 0 || + !remoteRelayNetworkEventCheckACL(callback->client, conn, net)) return -1; VIR_DEBUG("Relaying network lifecycle event %d, detail %d, callback %d", diff --git a/src/check-aclrules.pl b/src/check-aclrules.pl index 057517e..f54b934 100755 --- a/src/check-aclrules.pl +++ b/src/check-aclrules.pl @@ -1,6 +1,6 @@ #!/usr/bin/perl # -# Copyright (C) 2013 Red Hat, Inc. +# Copyright (C) 2013-2014 Red Hat, Inc. # # This library is free software; you can redistribute it and/or # modify it under the terms of the GNU Lesser General Public @@ -140,7 +140,10 @@ while (<PROTO>) { } elsif ($filtered && m,REMOTE_PROC_(.*)\s+=\s*\d+,) { my $api = name_to_ProcName($1); - $filtered{$api} = 1; + # Event filtering is handled in daemon/remote.c instead of drivers + if (! m,_EVENT_REGISTER,) { + $filtered{$api} = 1; + } $incomment = 0; } } diff --git a/src/conf/domain_event.c b/src/conf/domain_event.c index f56aed3..8639a01 100644 --- a/src/conf/domain_event.c +++ b/src/conf/domain_event.c @@ -360,30 +360,6 @@ virDomainEventDeviceRemovedDispose(void *obj) } -/** - * virDomainEventFilter: - * @conn: pointer to the connection - * @event: the event to check - * @opaque: opaque data holding ACL filter to use - * - * Internal function to run ACL filtering before dispatching an event - */ -static bool -virDomainEventFilter(virConnectPtr conn, virObjectEventPtr event, void *opaque) -{ - virDomainDef dom; - virDomainObjListFilter filter = opaque; - - /* For now, we just create a virDomainDef with enough contents to - * satisfy what viraccessdriverpolkit.c references. This is a bit - * fragile, but I don't know of anything better. */ - dom.name = event->meta.name; - memcpy(dom.uuid, event->meta.uuid, VIR_UUID_BUFLEN); - - return (filter)(conn, &dom); -} - - static void * virDomainEventNew(virClassPtr klass, int eventID, @@ -1289,7 +1265,6 @@ cleanup: * virDomainEventStateRegister: * @conn: connection to associate with callback * @state: object event state - * @filter: optional ACL filter to limit which events can be sent * @callback: the callback to add * @opaque: data blob to pass to @callback * @freecb: callback to free @opaque @@ -1302,7 +1277,6 @@ cleanup: int virDomainEventStateRegister(virConnectPtr conn, virObjectEventStatePtr state, - virDomainObjListFilter filter, virConnectDomainEventCallback callback, void *opaque, virFreeCallback freecb) @@ -1311,8 +1285,7 @@ virDomainEventStateRegister(virConnectPtr conn, return -1; return virObjectEventStateRegisterID(conn, state, NULL, - filter ? virDomainEventFilter : NULL, - filter, virDomainEventClass, + NULL, NULL, virDomainEventClass, VIR_DOMAIN_EVENT_ID_LIFECYCLE, VIR_OBJECT_EVENT_CALLBACK(callback), opaque, freecb, NULL, false); @@ -1323,7 +1296,6 @@ virDomainEventStateRegister(virConnectPtr conn, * virDomainEventStateRegisterID: * @conn: connection to associate with callback * @state: object event state - * @filter: optional ACL filter to limit which events can be sent * @dom: optional domain for filtering the event * @eventID: ID of the event type to register for * @cb: function to invoke when event fires @@ -1340,7 +1312,6 @@ virDomainEventStateRegister(virConnectPtr conn, int virDomainEventStateRegisterID(virConnectPtr conn, virObjectEventStatePtr state, - virDomainObjListFilter filter, virDomainPtr dom, int eventID, virConnectDomainEventGenericCallback cb, @@ -1352,8 +1323,8 @@ virDomainEventStateRegisterID(virConnectPtr conn, return -1; return virObjectEventStateRegisterID(conn, state, dom ? dom->uuid : NULL, - filter ? virDomainEventFilter : NULL, - filter, virDomainEventClass, eventID, + NULL, NULL, + virDomainEventClass, eventID, VIR_OBJECT_EVENT_CALLBACK(cb), opaque, freecb, callbackID, false); } diff --git a/src/conf/domain_event.h b/src/conf/domain_event.h index b39d5cd..b033b23 100644 --- a/src/conf/domain_event.h +++ b/src/conf/domain_event.h @@ -177,24 +177,20 @@ virDomainEventDeviceRemovedNewFromDom(virDomainPtr dom, int virDomainEventStateRegister(virConnectPtr conn, virObjectEventStatePtr state, - virDomainObjListFilter filter, virConnectDomainEventCallback callback, void *opaque, virFreeCallback freecb) - ATTRIBUTE_NONNULL(1) ATTRIBUTE_NONNULL(2) ATTRIBUTE_NONNULL(4); - + ATTRIBUTE_NONNULL(1) ATTRIBUTE_NONNULL(2) ATTRIBUTE_NONNULL(3); int virDomainEventStateRegisterID(virConnectPtr conn, virObjectEventStatePtr state, - virDomainObjListFilter filter, virDomainPtr dom, int eventID, virConnectDomainEventGenericCallback cb, void *opaque, virFreeCallback freecb, int *callbackID) - ATTRIBUTE_NONNULL(1) ATTRIBUTE_NONNULL(2) ATTRIBUTE_NONNULL(6); - + ATTRIBUTE_NONNULL(1) ATTRIBUTE_NONNULL(2) ATTRIBUTE_NONNULL(5); int virDomainEventStateDeregister(virConnectPtr conn, virObjectEventStatePtr state, diff --git a/src/conf/network_event.c b/src/conf/network_event.c index f27b7e9..4c59356 100644 --- a/src/conf/network_event.c +++ b/src/conf/network_event.c @@ -122,35 +122,9 @@ cleanup: /** - * virNetworkEventFilter: - * @conn: pointer to the connection - * @event: the event to check - * @opaque: opaque data holding ACL filter to use - * - * Internal function to run ACL filtering before dispatching an event - */ -static bool -virNetworkEventFilter(virConnectPtr conn, virObjectEventPtr event, - void *opaque) -{ - virNetworkDef net; - virNetworkObjListFilter filter = opaque; - - /* For now, we just create a virNetworkDef with enough contents to - * satisfy what viraccessdriverpolkit.c references. This is a bit - * fragile, but I don't know of anything better. */ - net.name = event->meta.name; - memcpy(net.uuid, event->meta.uuid, VIR_UUID_BUFLEN); - - return (filter)(conn, &net); -} - - -/** * virNetworkEventStateRegisterID: * @conn: connection to associate with callback * @state: object event state - * @filter: optional ACL filter to limit which events can be sent * @net: network to filter on or NULL for all networks * @eventID: ID of the event type to register for * @cb: function to invoke when event occurs @@ -167,7 +141,6 @@ virNetworkEventFilter(virConnectPtr conn, virObjectEventPtr event, int virNetworkEventStateRegisterID(virConnectPtr conn, virObjectEventStatePtr state, - virNetworkObjListFilter filter, virNetworkPtr net, int eventID, virConnectNetworkEventGenericCallback cb, @@ -179,8 +152,8 @@ virNetworkEventStateRegisterID(virConnectPtr conn, return -1; return virObjectEventStateRegisterID(conn, state, net ? net->uuid : NULL, - filter ? virNetworkEventFilter : NULL, - filter, virNetworkEventClass, eventID, + NULL, NULL, + virNetworkEventClass, eventID, VIR_OBJECT_EVENT_CALLBACK(cb), opaque, freecb, callbackID, false); } diff --git a/src/conf/network_event.h b/src/conf/network_event.h index 0812752..51bd949 100644 --- a/src/conf/network_event.h +++ b/src/conf/network_event.h @@ -24,7 +24,6 @@ #include "internal.h" #include "object_event.h" #include "object_event_private.h" -#include "network_conf.h" #ifndef __NETWORK_EVENT_H__ # define __NETWORK_EVENT_H__ @@ -32,15 +31,14 @@ int virNetworkEventStateRegisterID(virConnectPtr conn, virObjectEventStatePtr state, - virNetworkObjListFilter filter, virNetworkPtr net, int eventID, virConnectNetworkEventGenericCallback cb, void *opaque, virFreeCallback freecb, int *callbackID) - ATTRIBUTE_NONNULL(1) ATTRIBUTE_NONNULL(2) ATTRIBUTE_NONNULL(6) - ATTRIBUTE_NONNULL(9); + ATTRIBUTE_NONNULL(1) ATTRIBUTE_NONNULL(2) ATTRIBUTE_NONNULL(5) + ATTRIBUTE_NONNULL(8); int virNetworkEventStateRegisterClient(virConnectPtr conn, diff --git a/src/libxl/libxl_driver.c b/src/libxl/libxl_driver.c index fc0efa2..ad6231f 100644 --- a/src/libxl/libxl_driver.c +++ b/src/libxl/libxl_driver.c @@ -3654,7 +3654,6 @@ libxlConnectDomainEventRegister(virConnectPtr conn, if (virDomainEventStateRegister(conn, driver->domainEventState, - virConnectDomainEventRegisterCheckACL, callback, opaque, freecb) < 0) return -1; @@ -4260,7 +4259,6 @@ libxlConnectDomainEventRegisterAny(virConnectPtr conn, virDomainPtr dom, int eve if (virDomainEventStateRegisterID(conn, driver->domainEventState, - virConnectDomainEventRegisterAnyCheckACL, dom, eventID, callback, opaque, freecb, &ret) < 0) ret = -1; diff --git a/src/lxc/lxc_driver.c b/src/lxc/lxc_driver.c index 982f3fc..46c16bc 100644 --- a/src/lxc/lxc_driver.c +++ b/src/lxc/lxc_driver.c @@ -1293,7 +1293,6 @@ lxcConnectDomainEventRegister(virConnectPtr conn, if (virDomainEventStateRegister(conn, driver->domainEventState, - virConnectDomainEventRegisterCheckACL, callback, opaque, freecb) < 0) return -1; @@ -1335,7 +1334,6 @@ lxcConnectDomainEventRegisterAny(virConnectPtr conn, if (virDomainEventStateRegisterID(conn, driver->domainEventState, - virConnectDomainEventRegisterAnyCheckACL, dom, eventID, callback, opaque, freecb, &ret) < 0) ret = -1; diff --git a/src/network/bridge_driver.c b/src/network/bridge_driver.c index 6bdd1d6..45dff8a 100644 --- a/src/network/bridge_driver.c +++ b/src/network/bridge_driver.c @@ -2310,7 +2310,6 @@ networkConnectNetworkEventRegisterAny(virConnectPtr conn, goto cleanup; if (virNetworkEventStateRegisterID(conn, driver->networkEventState, - virConnectNetworkEventRegisterAnyCheckACL, net, eventID, callback, opaque, freecb, &ret) < 0) ret = -1; diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index a555470..4f134e9 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -10340,7 +10340,6 @@ qemuConnectDomainEventRegister(virConnectPtr conn, if (virDomainEventStateRegister(conn, driver->domainEventState, - virConnectDomainEventRegisterCheckACL, callback, opaque, freecb) < 0) goto cleanup; @@ -10389,7 +10388,6 @@ qemuConnectDomainEventRegisterAny(virConnectPtr conn, if (virDomainEventStateRegisterID(conn, driver->domainEventState, - virConnectDomainEventRegisterAnyCheckACL, dom, eventID, callback, opaque, freecb, &ret) < 0) ret = -1; diff --git a/src/remote/remote_driver.c b/src/remote/remote_driver.c index ca86e3c..18eb454 100644 --- a/src/remote/remote_driver.c +++ b/src/remote/remote_driver.c @@ -4427,7 +4427,7 @@ remoteConnectDomainEventRegister(virConnectPtr conn, remoteDriverLock(priv); - if ((count = virDomainEventStateRegister(conn, priv->eventState, NULL, + if ((count = virDomainEventStateRegister(conn, priv->eventState, callback, opaque, freecb)) < 0) goto done; @@ -5245,7 +5245,7 @@ remoteConnectDomainEventRegisterAny(virConnectPtr conn, remoteDriverLock(priv); - if ((count = virDomainEventStateRegisterID(conn, priv->eventState, NULL, + if ((count = virDomainEventStateRegisterID(conn, priv->eventState, dom, eventID, callback, opaque, freecb, &callbackID)) < 0) diff --git a/src/test/test_driver.c b/src/test/test_driver.c index 4c277bd..b724f82 100644 --- a/src/test/test_driver.c +++ b/src/test/test_driver.c @@ -6145,7 +6145,7 @@ testConnectDomainEventRegister(virConnectPtr conn, int ret = 0; testDriverLock(driver); - if (virDomainEventStateRegister(conn, driver->eventState, NULL, + if (virDomainEventStateRegister(conn, driver->eventState, callback, opaque, freecb) < 0) ret = -1; testDriverUnlock(driver); @@ -6183,7 +6183,7 @@ testConnectDomainEventRegisterAny(virConnectPtr conn, int ret; testDriverLock(driver); - if (virDomainEventStateRegisterID(conn, driver->eventState, NULL, + if (virDomainEventStateRegisterID(conn, driver->eventState, dom, eventID, callback, opaque, freecb, &ret) < 0) ret = -1; @@ -6221,7 +6221,7 @@ testConnectNetworkEventRegisterAny(virConnectPtr conn, int ret; testDriverLock(driver); - if (virNetworkEventStateRegisterID(conn, driver->eventState, NULL, + if (virNetworkEventStateRegisterID(conn, driver->eventState, net, eventID, callback, opaque, freecb, &ret) < 0) ret = -1; diff --git a/src/uml/uml_driver.c b/src/uml/uml_driver.c index 89afefe..dbd5da9 100644 --- a/src/uml/uml_driver.c +++ b/src/uml/uml_driver.c @@ -2617,7 +2617,6 @@ umlConnectDomainEventRegister(virConnectPtr conn, umlDriverLock(driver); if (virDomainEventStateRegister(conn, driver->domainEventState, - virConnectDomainEventRegisterCheckACL, callback, opaque, freecb) < 0) ret = -1; umlDriverUnlock(driver); @@ -2662,7 +2661,6 @@ umlConnectDomainEventRegisterAny(virConnectPtr conn, umlDriverLock(driver); if (virDomainEventStateRegisterID(conn, driver->domainEventState, - virConnectDomainEventRegisterAnyCheckACL, dom, eventID, callback, opaque, freecb, &ret) < 0) ret = -1; diff --git a/src/vbox/vbox_tmpl.c b/src/vbox/vbox_tmpl.c index 1be4dc4..382d7b4 100644 --- a/src/vbox/vbox_tmpl.c +++ b/src/vbox/vbox_tmpl.c @@ -7332,7 +7332,7 @@ vboxConnectDomainEventRegister(virConnectPtr conn, * later you can iterate over them */ - ret = virDomainEventStateRegister(conn, data->domainEvents, NULL, + ret = virDomainEventStateRegister(conn, data->domainEvents, callback, opaque, freecb); VIR_DEBUG("virObjectEventStateRegister (ret = %d) (conn: %p, " "callback: %p, opaque: %p, " @@ -7429,7 +7429,7 @@ static int vboxConnectDomainEventRegisterAny(virConnectPtr conn, * later you can iterate over them */ - if (virDomainEventStateRegisterID(conn, data->domainEvents, NULL, + if (virDomainEventStateRegisterID(conn, data->domainEvents, dom, eventID, callback, opaque, freecb, &ret) < 0) ret = -1; diff --git a/src/xen/xen_driver.c b/src/xen/xen_driver.c index c45d980..7506e8c 100644 --- a/src/xen/xen_driver.c +++ b/src/xen/xen_driver.c @@ -2323,7 +2323,6 @@ xenUnifiedConnectDomainEventRegister(virConnectPtr conn, } if (virDomainEventStateRegister(conn, priv->domainEvents, - virConnectDomainEventRegisterCheckACL, callback, opaque, freefunc) < 0) ret = -1; @@ -2383,7 +2382,6 @@ xenUnifiedConnectDomainEventRegisterAny(virConnectPtr conn, } if (virDomainEventStateRegisterID(conn, priv->domainEvents, - virConnectDomainEventRegisterAnyCheckACL, dom, eventID, callback, opaque, freefunc, &ret) < 0) ret = -1; -- 1.8.5.3
Commit f9f56340 for CVE-2014-0028 almost had the right idea - we need to check the ACL rules to filter which events to send. But it overlooked one thing: the event dispatch queue is running in the main loop thread, and therefore does not normally have a current virIdentityPtr. But filter checks can be based on current identity, so when libvirtd.conf contains access_drivers=["polkit"], we ended up rejecting access for EVERY event due to failure to look up the current identity, even if it should have been allowed. Furthermore, even for events that are triggered by API calls, it is important to remember that the point of events is that they can be copied across multiple connections, which may have separate identities and permissions. So even if events were dispatched from a context where we have an identity, we must change to the correct identity of the connection that will be receiving the event, rather than basing a decision on the context that triggered the event, when deciding whether to filter an event to a particular connection. If there were an easy way to get from virConnectPtr to the appropriate virIdentityPtr, then object_event.c could adjust the identity prior to checking whether to dispatch an event. But setting up that back-reference is a bit invasive. Instead, it is easier to delay the filtering check until lower down the stack, at the point where we have direct access to the RPC client object that owns an identity. As such, this patch ends up reverting a large portion of the framework of commit f9f56340. We also have to teach 'make check' to special-case the fact that the event registration filtering is done at the point of dispatch, rather than the point of registration. Note that even though we don't actually use virConnectDomainEventRegisterCheckACL (because the RegisterAny variant is sufficient), we still generate the function for the purposes of documenting that the filtering takes place. Also note that I did not entirely delete the notion of a filter from object_event.c; I still plan on using that for my upcoming patch series for qemu monitor events in libvirt-qemu.so. In other words, while this patch changes ACL filtering to live in remote.c and therefore we have no current client of the filtering in object_event.c, the notion of filtering in object_event.c is still useful down the road. * src/check-aclrules.pl: Exempt event registration from having to pass checkACL filter down call stack. * daemon/remote.c (remoteRelayDomainEventCheckACL) (remoteRelayNetworkEventCheckACL): New functions. (remoteRelay*Event*): Use new functions. * src/conf/domain_event.h (virDomainEventStateRegister) (virDomainEventStateRegisterID): Drop unused parameter. * src/conf/network_event.h (virNetworkEventStateRegisterID): Likewise. * src/conf/domain_event.c (virDomainEventFilter): Delete unused function. * src/conf/network_event.c (virNetworkEventFilter): Likewise. * src/libxl/libxl_driver.c: Adjust caller. * src/lxc/lxc_driver.c: Likewise. * src/network/bridge_driver.c: Likewise. * src/qemu/qemu_driver.c: Likewise. * src/remote/remote_driver.c: Likewise. * src/test/test_driver.c: Likewise. * src/uml/uml_driver.c: Likewise. * src/vbox/vbox_tmpl.c: Likewise. * src/xen/xen_driver.c: Likewise. Signed-off-by: Eric Blake <eblake@redhat.com> (cherry picked from commit TBD) Conflicts: daemon/remote.c - not backporting network events src/conf/network_event.c - likewise src/conf/network_event.h - likewise src/network/bridge_driver.c - likewise src/conf/domain_event.c - revert back to pre-CVE state src/conf/domain_event.h - likewise src/libxl/libxl_driver.c - likewise src/lxc/lxc_driver.c - likewise src/remote/remote_driver.c - likewise src/test/test_driver.c - likewise src/uml/uml_driver.c - likewise src/xen/xen_driver.c - likewise --- This is the backport to the various stable branches, assuming the main patch is accepted for the master branch. I'm also going to send an alternative representation that might make review easier. daemon/remote.c | 224 +++++++++++++++++++++++++++------------------ src/check-aclrules.pl | 7 +- src/conf/domain_event.c | 69 +------------- src/conf/domain_event.h | 8 +- src/libxl/libxl_driver.c | 2 - src/lxc/lxc_driver.c | 2 - src/qemu/qemu_driver.c | 2 - src/remote/remote_driver.c | 4 +- src/test/test_driver.c | 4 +- src/uml/uml_driver.c | 2 - src/vbox/vbox_tmpl.c | 4 +- src/xen/xen_driver.c | 2 - 12 files changed, 153 insertions(+), 177 deletions(-) diff --git a/daemon/remote.c b/daemon/remote.c index f3de6a0..22960bb 100644 --- a/daemon/remote.c +++ b/daemon/remote.c @@ -49,6 +49,8 @@ #include "qemu_protocol.h" #include "lxc_protocol.h" #include "virstring.h" +#include "domain_conf.h" +#include "viraccessapicheck.h" #define VIR_FROM_THIS VIR_FROM_RPC @@ -114,16 +116,45 @@ remoteDispatchDomainEventSend(virNetServerClientPtr client, xdrproc_t proc, void *data); -static int remoteRelayDomainEventLifecycle(virConnectPtr conn ATTRIBUTE_UNUSED, - virDomainPtr dom, - int event, - int detail, - void *opaque) + +static bool +remoteRelayDomainEventCheckACL(virNetServerClientPtr client, + virConnectPtr conn, virDomainPtr dom) +{ + virDomainDef def; + virIdentityPtr identity = NULL; + bool ret = false; + + /* For now, we just create a virDomainDef with enough contents to + * satisfy what viraccessdriverpolkit.c references. This is a bit + * fragile, but I don't know of anything better. */ + def.name = dom->name; + memcpy(def.uuid, dom->uuid, VIR_UUID_BUFLEN); + + if (!(identity = virNetServerClientGetIdentity(client))) + goto cleanup; + if (virIdentitySetCurrent(identity) < 0) + goto cleanup; + ret = virConnectDomainEventRegisterAnyCheckACL(conn, &def); + +cleanup: + ignore_value(virIdentitySetCurrent(NULL)); + virObjectUnref(identity); + return ret; +} + + +static int +remoteRelayDomainEventLifecycle(virConnectPtr conn, + virDomainPtr dom, + int event, + int detail, + void *opaque) { virNetServerClientPtr client = opaque; remote_domain_event_lifecycle_msg data; - if (!client) + if (!client || !remoteRelayDomainEventCheckACL(client, conn, dom)) return -1; VIR_DEBUG("Relaying domain lifecycle event %d %d", event, detail); @@ -141,14 +172,15 @@ static int remoteRelayDomainEventLifecycle(virConnectPtr conn ATTRIBUTE_UNUSED, return 0; } -static int remoteRelayDomainEventReboot(virConnectPtr conn ATTRIBUTE_UNUSED, - virDomainPtr dom, - void *opaque) +static int +remoteRelayDomainEventReboot(virConnectPtr conn, + virDomainPtr dom, + void *opaque) { virNetServerClientPtr client = opaque; remote_domain_event_reboot_msg data; - if (!client) + if (!client || !remoteRelayDomainEventCheckACL(client, conn, dom)) return -1; VIR_DEBUG("Relaying domain reboot event %s %d", dom->name, dom->id); @@ -165,15 +197,16 @@ static int remoteRelayDomainEventReboot(virConnectPtr conn ATTRIBUTE_UNUSED, } -static int remoteRelayDomainEventRTCChange(virConnectPtr conn ATTRIBUTE_UNUSED, - virDomainPtr dom, - long long offset, - void *opaque) +static int +remoteRelayDomainEventRTCChange(virConnectPtr conn, + virDomainPtr dom, + long long offset, + void *opaque) { virNetServerClientPtr client = opaque; remote_domain_event_rtc_change_msg data; - if (!client) + if (!client || !remoteRelayDomainEventCheckACL(client, conn, dom)) return -1; VIR_DEBUG("Relaying domain rtc change event %s %d %lld", dom->name, dom->id, offset); @@ -191,15 +224,16 @@ static int remoteRelayDomainEventRTCChange(virConnectPtr conn ATTRIBUTE_UNUSED, } -static int remoteRelayDomainEventWatchdog(virConnectPtr conn ATTRIBUTE_UNUSED, - virDomainPtr dom, - int action, - void *opaque) +static int +remoteRelayDomainEventWatchdog(virConnectPtr conn, + virDomainPtr dom, + int action, + void *opaque) { virNetServerClientPtr client = opaque; remote_domain_event_watchdog_msg data; - if (!client) + if (!client || !remoteRelayDomainEventCheckACL(client, conn, dom)) return -1; VIR_DEBUG("Relaying domain watchdog event %s %d %d", dom->name, dom->id, action); @@ -217,17 +251,18 @@ static int remoteRelayDomainEventWatchdog(virConnectPtr conn ATTRIBUTE_UNUSED, } -static int remoteRelayDomainEventIOError(virConnectPtr conn ATTRIBUTE_UNUSED, - virDomainPtr dom, - const char *srcPath, - const char *devAlias, - int action, - void *opaque) +static int +remoteRelayDomainEventIOError(virConnectPtr conn, + virDomainPtr dom, + const char *srcPath, + const char *devAlias, + int action, + void *opaque) { virNetServerClientPtr client = opaque; remote_domain_event_io_error_msg data; - if (!client) + if (!client || !remoteRelayDomainEventCheckACL(client, conn, dom)) return -1; VIR_DEBUG("Relaying domain io error %s %d %s %s %d", dom->name, dom->id, srcPath, devAlias, action); @@ -252,18 +287,19 @@ error: } -static int remoteRelayDomainEventIOErrorReason(virConnectPtr conn ATTRIBUTE_UNUSED, - virDomainPtr dom, - const char *srcPath, - const char *devAlias, - int action, - const char *reason, - void *opaque) +static int +remoteRelayDomainEventIOErrorReason(virConnectPtr conn, + virDomainPtr dom, + const char *srcPath, + const char *devAlias, + int action, + const char *reason, + void *opaque) { virNetServerClientPtr client = opaque; remote_domain_event_io_error_reason_msg data; - if (!client) + if (!client || !remoteRelayDomainEventCheckACL(client, conn, dom)) return -1; VIR_DEBUG("Relaying domain io error %s %d %s %s %d %s", @@ -293,20 +329,21 @@ error: } -static int remoteRelayDomainEventGraphics(virConnectPtr conn ATTRIBUTE_UNUSED, - virDomainPtr dom, - int phase, - virDomainEventGraphicsAddressPtr local, - virDomainEventGraphicsAddressPtr remote, - const char *authScheme, - virDomainEventGraphicsSubjectPtr subject, - void *opaque) +static int +remoteRelayDomainEventGraphics(virConnectPtr conn, + virDomainPtr dom, + int phase, + virDomainEventGraphicsAddressPtr local, + virDomainEventGraphicsAddressPtr remote, + const char *authScheme, + virDomainEventGraphicsSubjectPtr subject, + void *opaque) { virNetServerClientPtr client = opaque; remote_domain_event_graphics_msg data; size_t i; - if (!client) + if (!client || !remoteRelayDomainEventCheckACL(client, conn, dom)) return -1; VIR_DEBUG("Relaying domain graphics event %s %d %d - %d %s %s - %d %s %s - %s", dom->name, dom->id, phase, @@ -364,17 +401,18 @@ error: return -1; } -static int remoteRelayDomainEventBlockJob(virConnectPtr conn ATTRIBUTE_UNUSED, - virDomainPtr dom, - const char *path, - int type, - int status, - void *opaque) +static int +remoteRelayDomainEventBlockJob(virConnectPtr conn, + virDomainPtr dom, + const char *path, + int type, + int status, + void *opaque) { virNetServerClientPtr client = opaque; remote_domain_event_block_job_msg data; - if (!client) + if (!client || !remoteRelayDomainEventCheckACL(client, conn, dom)) return -1; VIR_DEBUG("Relaying domain block job event %s %d %s %i, %i", @@ -399,14 +437,15 @@ error: } -static int remoteRelayDomainEventControlError(virConnectPtr conn ATTRIBUTE_UNUSED, - virDomainPtr dom, - void *opaque) +static int +remoteRelayDomainEventControlError(virConnectPtr conn, + virDomainPtr dom, + void *opaque) { virNetServerClientPtr client = opaque; remote_domain_event_control_error_msg data; - if (!client) + if (!client || !remoteRelayDomainEventCheckACL(client, conn, dom)) return -1; VIR_DEBUG("Relaying domain control error %s %d", dom->name, dom->id); @@ -423,19 +462,20 @@ static int remoteRelayDomainEventControlError(virConnectPtr conn ATTRIBUTE_UNUSE } -static int remoteRelayDomainEventDiskChange(virConnectPtr conn ATTRIBUTE_UNUSED, - virDomainPtr dom, - const char *oldSrcPath, - const char *newSrcPath, - const char *devAlias, - int reason, - void *opaque) +static int +remoteRelayDomainEventDiskChange(virConnectPtr conn, + virDomainPtr dom, + const char *oldSrcPath, + const char *newSrcPath, + const char *devAlias, + int reason, + void *opaque) { virNetServerClientPtr client = opaque; remote_domain_event_disk_change_msg data; char **oldSrcPath_p = NULL, **newSrcPath_p = NULL; - if (!client) + if (!client || !remoteRelayDomainEventCheckACL(client, conn, dom)) return -1; VIR_DEBUG("Relaying domain %s %d disk change %s %s %s %d", @@ -474,15 +514,17 @@ error: } -static int remoteRelayDomainEventTrayChange(virConnectPtr conn ATTRIBUTE_UNUSED, - virDomainPtr dom, - const char *devAlias, - int reason, - void *opaque) { +static int +remoteRelayDomainEventTrayChange(virConnectPtr conn, + virDomainPtr dom, + const char *devAlias, + int reason, + void *opaque) +{ virNetServerClientPtr client = opaque; remote_domain_event_tray_change_msg data; - if (!client) + if (!client || !remoteRelayDomainEventCheckACL(client, conn, dom)) return -1; VIR_DEBUG("Relaying domain %s %d tray change devAlias: %s reason: %d", @@ -504,14 +546,16 @@ static int remoteRelayDomainEventTrayChange(virConnectPtr conn ATTRIBUTE_UNUSED, return 0; } -static int remoteRelayDomainEventPMWakeup(virConnectPtr conn ATTRIBUTE_UNUSED, - virDomainPtr dom, - int reason ATTRIBUTE_UNUSED, - void *opaque) { +static int +remoteRelayDomainEventPMWakeup(virConnectPtr conn, + virDomainPtr dom, + int reason ATTRIBUTE_UNUSED, + void *opaque) +{ virNetServerClientPtr client = opaque; remote_domain_event_pmwakeup_msg data; - if (!client) + if (!client || !remoteRelayDomainEventCheckACL(client, conn, dom)) return -1; VIR_DEBUG("Relaying domain %s %d system pmwakeup", dom->name, dom->id); @@ -527,14 +571,16 @@ static int remoteRelayDomainEventPMWakeup(virConnectPtr conn ATTRIBUTE_UNUSED, return 0; } -static int remoteRelayDomainEventPMSuspend(virConnectPtr conn ATTRIBUTE_UNUSED, - virDomainPtr dom, - int reason ATTRIBUTE_UNUSED, - void *opaque) { +static int +remoteRelayDomainEventPMSuspend(virConnectPtr conn, + virDomainPtr dom, + int reason ATTRIBUTE_UNUSED, + void *opaque) +{ virNetServerClientPtr client = opaque; remote_domain_event_pmsuspend_msg data; - if (!client) + if (!client || !remoteRelayDomainEventCheckACL(client, conn, dom)) return -1; VIR_DEBUG("Relaying domain %s %d system pmsuspend", dom->name, dom->id); @@ -551,7 +597,7 @@ static int remoteRelayDomainEventPMSuspend(virConnectPtr conn ATTRIBUTE_UNUSED, } static int -remoteRelayDomainEventBalloonChange(virConnectPtr conn ATTRIBUTE_UNUSED, +remoteRelayDomainEventBalloonChange(virConnectPtr conn, virDomainPtr dom, unsigned long long actual, void *opaque) @@ -559,7 +605,7 @@ remoteRelayDomainEventBalloonChange(virConnectPtr conn ATTRIBUTE_UNUSED, virNetServerClientPtr client = opaque; remote_domain_event_balloon_change_msg data; - if (!client) + if (!client || !remoteRelayDomainEventCheckACL(client, conn, dom)) return -1; VIR_DEBUG("Relaying domain balloon change event %s %d %lld", dom->name, dom->id, actual); @@ -577,14 +623,16 @@ remoteRelayDomainEventBalloonChange(virConnectPtr conn ATTRIBUTE_UNUSED, } -static int remoteRelayDomainEventPMSuspendDisk(virConnectPtr conn ATTRIBUTE_UNUSED, - virDomainPtr dom, - int reason ATTRIBUTE_UNUSED, - void *opaque) { +static int +remoteRelayDomainEventPMSuspendDisk(virConnectPtr conn, + virDomainPtr dom, + int reason ATTRIBUTE_UNUSED, + void *opaque) +{ virNetServerClientPtr client = opaque; remote_domain_event_pmsuspend_disk_msg data; - if (!client) + if (!client || !remoteRelayDomainEventCheckACL(client, conn, dom)) return -1; VIR_DEBUG("Relaying domain %s %d system pmsuspend-disk", dom->name, dom->id); @@ -601,7 +649,7 @@ static int remoteRelayDomainEventPMSuspendDisk(virConnectPtr conn ATTRIBUTE_UNUS } static int -remoteRelayDomainEventDeviceRemoved(virConnectPtr conn ATTRIBUTE_UNUSED, +remoteRelayDomainEventDeviceRemoved(virConnectPtr conn, virDomainPtr dom, const char *devAlias, void *opaque) @@ -609,7 +657,7 @@ remoteRelayDomainEventDeviceRemoved(virConnectPtr conn ATTRIBUTE_UNUSED, virNetServerClientPtr client = opaque; remote_domain_event_device_removed_msg data; - if (!client) + if (!client || !remoteRelayDomainEventCheckACL(client, conn, dom)) return -1; VIR_DEBUG("Relaying domain device removed event %s %d %s", diff --git a/src/check-aclrules.pl b/src/check-aclrules.pl index 057517e..f54b934 100644 --- a/src/check-aclrules.pl +++ b/src/check-aclrules.pl @@ -1,6 +1,6 @@ #!/usr/bin/perl # -# Copyright (C) 2013 Red Hat, Inc. +# Copyright (C) 2013-2014 Red Hat, Inc. # # This library is free software; you can redistribute it and/or # modify it under the terms of the GNU Lesser General Public @@ -140,7 +140,10 @@ while (<PROTO>) { } elsif ($filtered && m,REMOTE_PROC_(.*)\s+=\s*\d+,) { my $api = name_to_ProcName($1); - $filtered{$api} = 1; + # Event filtering is handled in daemon/remote.c instead of drivers + if (! m,_EVENT_REGISTER,) { + $filtered{$api} = 1; + } $incomment = 0; } } diff --git a/src/conf/domain_event.c b/src/conf/domain_event.c index 1736aa0..de55d08 100644 --- a/src/conf/domain_event.c +++ b/src/conf/domain_event.c @@ -32,20 +32,6 @@ #define VIR_FROM_THIS VIR_FROM_NONE -/** - * virObjectEventCallbackFilter: - * @conn: the connection pointer - * @event: the event about to be dispatched - * @opaque: opaque data registered with the filter - * - * Callback to do final filtering for a reason not tracked directly by - * virObjectEventStateRegisterID(). Return false if @event must not - * be sent to @conn. - */ -typedef bool (*virObjectEventCallbackFilter)(virConnectPtr conn, - virDomainEventPtr event, - void *opaque); - struct _virDomainMeta { int id; char *name; @@ -82,8 +68,6 @@ struct _virDomainEventCallback { int eventID; virConnectPtr conn; virDomainMetaPtr dom; - virObjectEventCallbackFilter filter; - void *filter_opaque; virConnectDomainEventGenericCallback cb; void *opaque; virFreeCallback freecb; @@ -360,9 +344,6 @@ virDomainEventCallbackListPurgeMarked(virDomainEventCallbackListPtr cbList) * virDomainEventCallbackListAddID: * @conn: pointer to the connection * @cbList: the list - * @dom: optional domain to filter on - * @filter optional last-ditch filter callback - * @filter_opaque: opaque data to pass to @filter * @eventID: the event ID * @callback: the callback to add * @opaque: opaque data tio pass to callback @@ -374,8 +355,6 @@ static int virDomainEventCallbackListAddID(virConnectPtr conn, virDomainEventCallbackListPtr cbList, virDomainPtr dom, - virObjectEventCallbackFilter filter, - void *filter_opaque, int eventID, virConnectDomainEventGenericCallback callback, void *opaque, @@ -422,8 +401,6 @@ virDomainEventCallbackListAddID(virConnectPtr conn, memcpy(event->dom->uuid, dom->uuid, VIR_UUID_BUFLEN); event->dom->id = dom->id; } - event->filter = filter; - event->filter_opaque = filter_opaque; /* Make space on list */ if (VIR_REALLOC_N(cbList->callbacks, cbList->count + 1) < 0) @@ -463,8 +440,6 @@ error: * virDomainEventCallbackListAdd: * @conn: pointer to the connection * @cbList: the list - * @filter optional last-ditch filter callback - * @filter_opaque: opaque data to pass to @filter * @callback: the callback to add * @opaque: opaque data tio pass to callback * @@ -473,14 +448,11 @@ error: static int virDomainEventCallbackListAdd(virConnectPtr conn, virDomainEventCallbackListPtr cbList, - virObjectEventCallbackFilter filter, - void *filter_opaque, virConnectDomainEventCallback callback, void *opaque, virFreeCallback freecb) { return virDomainEventCallbackListAddID(conn, cbList, NULL, - filter, filter_opaque, VIR_DOMAIN_EVENT_ID_LIFECYCLE, VIR_DOMAIN_EVENT_CALLBACK(callback), opaque, freecb, NULL); @@ -708,32 +680,6 @@ static virDomainEventPtr virDomainEventNewInternal(int eventID, return event; } - -/** - * virDomainEventFilter: - * @conn: pointer to the connection - * @event: the event to check - * @opaque: opaque data holding ACL filter to use - * - * Internal function to run ACL filtering before dispatching an event - */ -static bool -virDomainEventFilter(virConnectPtr conn, virDomainEventPtr event, - void *opaque) -{ - virDomainDef dom; - virDomainObjListFilter filter = opaque; - - /* For now, we just create a virDomainDef with enough contents to - * satisfy what viraccessdriverpolkit.c references. This is a bit - * fragile, but I don't know of anything better. */ - dom.name = event->dom.name; - memcpy(dom.uuid, event->dom.uuid, VIR_UUID_BUFLEN); - - return (filter)(conn, &dom); -} - - virDomainEventPtr virDomainEventNew(int id, const char *name, const unsigned char *uuid, int type, int detail) @@ -1435,9 +1381,6 @@ static int virDomainEventDispatchMatchCallback(virDomainEventPtr event, if (cb->eventID != event->eventID) return 0; - if (cb->filter && !(cb->filter)(cb->conn, event, cb->filter_opaque)) - return 0; - if (cb->dom) { /* Deliberately ignoring 'id' for matching, since that * will cause problems when a domain switches between @@ -1567,7 +1510,6 @@ virDomainEventStateFlush(virDomainEventStatePtr state) * virDomainEventStateRegister: * @conn: connection to associate with callback * @state: domain event state - * @filter: optional ACL filter to limit which events can be sent * @callback: function to remove from event * @opaque: data blob to pass to callback * @freecb: callback to free @opaque @@ -1580,7 +1522,6 @@ virDomainEventStateFlush(virDomainEventStatePtr state) int virDomainEventStateRegister(virConnectPtr conn, virDomainEventStatePtr state, - virDomainObjListFilter filter, virConnectDomainEventCallback callback, void *opaque, virFreeCallback freecb) @@ -1601,8 +1542,7 @@ virDomainEventStateRegister(virConnectPtr conn, } ret = virDomainEventCallbackListAdd(conn, state->callbacks, - filter ? virDomainEventFilter : NULL, - filter, callback, opaque, freecb); + callback, opaque, freecb); if (ret == -1 && state->callbacks->count == 0 && @@ -1621,7 +1561,6 @@ cleanup: * virDomainEventStateRegisterID: * @conn: connection to associate with callback * @state: domain event state - * @filter: optional ACL filter to limit which events can be sent * @eventID: ID of the event type to register for * @cb: function to remove from event * @opaque: data blob to pass to callback @@ -1636,7 +1575,6 @@ cleanup: int virDomainEventStateRegisterID(virConnectPtr conn, virDomainEventStatePtr state, - virDomainObjListFilter filter, virDomainPtr dom, int eventID, virConnectDomainEventGenericCallback cb, @@ -1659,9 +1597,8 @@ virDomainEventStateRegisterID(virConnectPtr conn, goto cleanup; } - ret = virDomainEventCallbackListAddID(conn, state->callbacks, dom, - filter ? virDomainEventFilter : NULL, - filter, eventID, cb, opaque, freecb, + ret = virDomainEventCallbackListAddID(conn, state->callbacks, + dom, eventID, cb, opaque, freecb, callbackID); if (ret == -1 && diff --git a/src/conf/domain_event.h b/src/conf/domain_event.h index 9dc65e2..f6b957d 100644 --- a/src/conf/domain_event.h +++ b/src/conf/domain_event.h @@ -1,7 +1,7 @@ /* * domain_event.h: domain event queue processing helpers * - * Copyright (C) 2012-2014 Red Hat, Inc. + * Copyright (C) 2012 Red Hat, Inc. * Copyright (C) 2008 VirtualIron * * This library is free software; you can redistribute it and/or @@ -149,21 +149,19 @@ virDomainEventStateQueue(virDomainEventStatePtr state, ATTRIBUTE_NONNULL(1) ATTRIBUTE_NONNULL(2); int virDomainEventStateRegister(virConnectPtr conn, virDomainEventStatePtr state, - virDomainObjListFilter filter, virConnectDomainEventCallback callback, void *opaque, virFreeCallback freecb) - ATTRIBUTE_NONNULL(1) ATTRIBUTE_NONNULL(2) ATTRIBUTE_NONNULL(4); + ATTRIBUTE_NONNULL(1) ATTRIBUTE_NONNULL(2) ATTRIBUTE_NONNULL(3); int virDomainEventStateRegisterID(virConnectPtr conn, virDomainEventStatePtr state, - virDomainObjListFilter filter, virDomainPtr dom, int eventID, virConnectDomainEventGenericCallback cb, void *opaque, virFreeCallback freecb, int *callbackID) - ATTRIBUTE_NONNULL(1) ATTRIBUTE_NONNULL(2) ATTRIBUTE_NONNULL(6); + ATTRIBUTE_NONNULL(1) ATTRIBUTE_NONNULL(2) ATTRIBUTE_NONNULL(5); int virDomainEventStateDeregister(virConnectPtr conn, virDomainEventStatePtr state, diff --git a/src/libxl/libxl_driver.c b/src/libxl/libxl_driver.c index bcae193..764a686 100644 --- a/src/libxl/libxl_driver.c +++ b/src/libxl/libxl_driver.c @@ -3518,7 +3518,6 @@ libxlConnectDomainEventRegister(virConnectPtr conn, ret = virDomainEventStateRegister(conn, driver->domainEventState, - virConnectDomainEventRegisterCheckACL, callback, opaque, freecb); return ret; @@ -4118,7 +4117,6 @@ libxlConnectDomainEventRegisterAny(virConnectPtr conn, virDomainPtr dom, int eve if (virDomainEventStateRegisterID(conn, driver->domainEventState, - virConnectDomainEventRegisterAnyCheckACL, dom, eventID, callback, opaque, freecb, &ret) < 0) ret = -1; diff --git a/src/lxc/lxc_driver.c b/src/lxc/lxc_driver.c index 94b4668..54b457a 100644 --- a/src/lxc/lxc_driver.c +++ b/src/lxc/lxc_driver.c @@ -1294,7 +1294,6 @@ lxcConnectDomainEventRegister(virConnectPtr conn, ret = virDomainEventStateRegister(conn, driver->domainEventState, - virConnectDomainEventRegisterCheckACL, callback, opaque, freecb); return ret; @@ -1335,7 +1334,6 @@ lxcConnectDomainEventRegisterAny(virConnectPtr conn, if (virDomainEventStateRegisterID(conn, driver->domainEventState, - virConnectDomainEventRegisterAnyCheckACL, dom, eventID, callback, opaque, freecb, &ret) < 0) ret = -1; diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 9666d39..a289fe2 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -9861,7 +9861,6 @@ qemuConnectDomainEventRegister(virConnectPtr conn, if (virDomainEventStateRegister(conn, driver->domainEventState, - virConnectDomainEventRegisterCheckACL, callback, opaque, freecb) < 0) goto cleanup; @@ -9910,7 +9909,6 @@ qemuConnectDomainEventRegisterAny(virConnectPtr conn, if (virDomainEventStateRegisterID(conn, driver->domainEventState, - virConnectDomainEventRegisterAnyCheckACL, dom, eventID, callback, opaque, freecb, &ret) < 0) ret = -1; diff --git a/src/remote/remote_driver.c b/src/remote/remote_driver.c index 4508ca9..ff20191 100644 --- a/src/remote/remote_driver.c +++ b/src/remote/remote_driver.c @@ -4311,7 +4311,7 @@ static int remoteConnectDomainEventRegister(virConnectPtr conn, remoteDriverLock(priv); - if ((count = virDomainEventStateRegister(conn, priv->domainEventState, NULL, + if ((count = virDomainEventStateRegister(conn, priv->domainEventState, callback, opaque, freecb)) < 0) { virReportError(VIR_ERR_RPC, "%s", _("adding cb to list")); goto done; @@ -5097,7 +5097,7 @@ static int remoteConnectDomainEventRegisterAny(virConnectPtr conn, remoteDriverLock(priv); if ((count = virDomainEventStateRegisterID(conn, - priv->domainEventState, NULL, + priv->domainEventState, dom, eventID, callback, opaque, freecb, &callbackID)) < 0) { diff --git a/src/test/test_driver.c b/src/test/test_driver.c index e853099..48b5ec1 100644 --- a/src/test/test_driver.c +++ b/src/test/test_driver.c @@ -5772,7 +5772,7 @@ testConnectDomainEventRegister(virConnectPtr conn, testDriverLock(driver); ret = virDomainEventStateRegister(conn, - driver->domainEventState, NULL, + driver->domainEventState, callback, opaque, freecb); testDriverUnlock(driver); @@ -5810,7 +5810,7 @@ testConnectDomainEventRegisterAny(virConnectPtr conn, testDriverLock(driver); if (virDomainEventStateRegisterID(conn, - driver->domainEventState, NULL, + driver->domainEventState, dom, eventID, callback, opaque, freecb, &ret) < 0) ret = -1; diff --git a/src/uml/uml_driver.c b/src/uml/uml_driver.c index cf7f334..eb02542 100644 --- a/src/uml/uml_driver.c +++ b/src/uml/uml_driver.c @@ -2617,7 +2617,6 @@ umlConnectDomainEventRegister(virConnectPtr conn, umlDriverLock(driver); ret = virDomainEventStateRegister(conn, driver->domainEventState, - virConnectDomainEventRegisterCheckACL, callback, opaque, freecb); umlDriverUnlock(driver); @@ -2660,7 +2659,6 @@ umlConnectDomainEventRegisterAny(virConnectPtr conn, umlDriverLock(driver); if (virDomainEventStateRegisterID(conn, driver->domainEventState, - virConnectDomainEventRegisterAnyCheckACL, dom, eventID, callback, opaque, freecb, &ret) < 0) ret = -1; diff --git a/src/vbox/vbox_tmpl.c b/src/vbox/vbox_tmpl.c index 27f4197..5b17048 100644 --- a/src/vbox/vbox_tmpl.c +++ b/src/vbox/vbox_tmpl.c @@ -7265,7 +7265,7 @@ static int vboxConnectDomainEventRegister(virConnectPtr conn, * later you can iterate over them */ - ret = virDomainEventStateRegister(conn, data->domainEvents, NULL, + ret = virDomainEventStateRegister(conn, data->domainEvents, callback, opaque, freecb); VIR_DEBUG("virDomainEventStateRegister (ret = %d) (conn: %p, " "callback: %p, opaque: %p, " @@ -7357,7 +7357,7 @@ static int vboxConnectDomainEventRegisterAny(virConnectPtr conn, * later you can iterate over them */ - if (virDomainEventStateRegisterID(conn, data->domainEvents, NULL, + if (virDomainEventStateRegisterID(conn, data->domainEvents, dom, eventID, callback, opaque, freecb, &ret) < 0) ret = -1; diff --git a/src/xen/xen_driver.c b/src/xen/xen_driver.c index 13fc517..40b98ee 100644 --- a/src/xen/xen_driver.c +++ b/src/xen/xen_driver.c @@ -2316,7 +2316,6 @@ xenUnifiedConnectDomainEventRegister(virConnectPtr conn, } ret = virDomainEventStateRegister(conn, priv->domainEvents, - virConnectDomainEventRegisterCheckACL, callback, opaque, freefunc); xenUnifiedUnlock(priv); @@ -2374,7 +2373,6 @@ xenUnifiedConnectDomainEventRegisterAny(virConnectPtr conn, } if (virDomainEventStateRegisterID(conn, priv->domainEvents, - virConnectDomainEventRegisterAnyCheckACL, dom, eventID, callback, opaque, freefunc, &ret) < 0) ret = -1; -- 1.8.5.3
On Tue, Jan 28, 2014 at 05:14:40PM -0700, Eric Blake wrote:
Commit f9f56340 for CVE-2014-0028 almost had the right idea - we need to check the ACL rules to filter which events to send. But it overlooked one thing: the event dispatch queue is running in the main loop thread, and therefore does not normally have a current virIdentityPtr. But filter checks can be based on current identity, so when libvirtd.conf contains access_drivers=["polkit"], we ended up rejecting access for EVERY event due to failure to look up the current identity, even if it should have been allowed.
Furthermore, even for events that are triggered by API calls, it is important to remember that the point of events is that they can be copied across multiple connections, which may have separate identities and permissions. So even if events were dispatched from a context where we have an identity, we must change to the correct identity of the connection that will be receiving the event, rather than basing a decision on the context that triggered the event, when deciding whether to filter an event to a particular connection.
If there were an easy way to get from virConnectPtr to the appropriate virIdentityPtr, then object_event.c could adjust the identity prior to checking whether to dispatch an event. But setting up that back-reference is a bit invasive. Instead, it is easier to delay the filtering check until lower down the stack, at the point where we have direct access to the RPC client object that owns an identity. As such, this patch ends up reverting a large portion of the framework of commit f9f56340. We also have to teach 'make check' to special-case the fact that the event registration filtering is done at the point of dispatch, rather than the point of registration. Note that even though we don't actually use virConnectDomainEventRegisterCheckACL (because the RegisterAny variant is sufficient), we still generate the function for the purposes of documenting that the filtering takes place.
Also note that I did not entirely delete the notion of a filter from object_event.c; I still plan on using that for my upcoming patch series for qemu monitor events in libvirt-qemu.so. In other words, while this patch changes ACL filtering to live in remote.c and therefore we have no current client of the filtering in object_event.c, the notion of filtering in object_event.c is still useful down the road.
* src/check-aclrules.pl: Exempt event registration from having to pass checkACL filter down call stack. * daemon/remote.c (remoteRelayDomainEventCheckACL) (remoteRelayNetworkEventCheckACL): New functions. (remoteRelay*Event*): Use new functions. * src/conf/domain_event.h (virDomainEventStateRegister) (virDomainEventStateRegisterID): Drop unused parameter. * src/conf/network_event.h (virNetworkEventStateRegisterID): Likewise. * src/conf/domain_event.c (virDomainEventFilter): Delete unused function. * src/conf/network_event.c (virNetworkEventFilter): Likewise. * src/libxl/libxl_driver.c: Adjust caller. * src/lxc/lxc_driver.c: Likewise. * src/network/bridge_driver.c: Likewise. * src/qemu/qemu_driver.c: Likewise. * src/remote/remote_driver.c: Likewise. * src/test/test_driver.c: Likewise. * src/uml/uml_driver.c: Likewise. * src/vbox/vbox_tmpl.c: Likewise. * src/xen/xen_driver.c: Likewise.
Signed-off-by: Eric Blake <eblake@redhat.com> (cherry picked from commit TBD)
Conflicts: daemon/remote.c - not backporting network events src/conf/network_event.c - likewise src/conf/network_event.h - likewise src/network/bridge_driver.c - likewise src/conf/domain_event.c - revert back to pre-CVE state src/conf/domain_event.h - likewise src/libxl/libxl_driver.c - likewise src/lxc/lxc_driver.c - likewise src/remote/remote_driver.c - likewise src/test/test_driver.c - likewise src/uml/uml_driver.c - likewise src/xen/xen_driver.c - likewise ---
This is the backport to the various stable branches, assuming the main patch is accepted for the master branch. I'm also going to send an alternative representation that might make review easier.
ACK Daniel -- |: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :| |: http://libvirt.org -o- http://virt-manager.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: http://entangle-photo.org -o- http://live.gnome.org/gtk-vnc :|
It's almost simpler to revert the botched CVE-2014-0028 patch and show just the final result with filtering in the right location. Signed-off-by: Eric Blake <eblake@redhat.com> --- Created by squashing the original CVE fix together with the updates to filter in remote.c; this representation avoids dealing with the churn of reverting hunks between patches. daemon/remote.c | 224 ++++++++++++++++++++++++++----------------- src/access/viraccessperm.h | 4 +- src/check-aclrules.pl | 7 +- src/remote/remote_protocol.x | 8 +- 4 files changed, 148 insertions(+), 95 deletions(-) diff --git a/daemon/remote.c b/daemon/remote.c index f3de6a0..22960bb 100644 --- a/daemon/remote.c +++ b/daemon/remote.c @@ -49,6 +49,8 @@ #include "qemu_protocol.h" #include "lxc_protocol.h" #include "virstring.h" +#include "domain_conf.h" +#include "viraccessapicheck.h" #define VIR_FROM_THIS VIR_FROM_RPC @@ -114,16 +116,45 @@ remoteDispatchDomainEventSend(virNetServerClientPtr client, xdrproc_t proc, void *data); -static int remoteRelayDomainEventLifecycle(virConnectPtr conn ATTRIBUTE_UNUSED, - virDomainPtr dom, - int event, - int detail, - void *opaque) + +static bool +remoteRelayDomainEventCheckACL(virNetServerClientPtr client, + virConnectPtr conn, virDomainPtr dom) +{ + virDomainDef def; + virIdentityPtr identity = NULL; + bool ret = false; + + /* For now, we just create a virDomainDef with enough contents to + * satisfy what viraccessdriverpolkit.c references. This is a bit + * fragile, but I don't know of anything better. */ + def.name = dom->name; + memcpy(def.uuid, dom->uuid, VIR_UUID_BUFLEN); + + if (!(identity = virNetServerClientGetIdentity(client))) + goto cleanup; + if (virIdentitySetCurrent(identity) < 0) + goto cleanup; + ret = virConnectDomainEventRegisterAnyCheckACL(conn, &def); + +cleanup: + ignore_value(virIdentitySetCurrent(NULL)); + virObjectUnref(identity); + return ret; +} + + +static int +remoteRelayDomainEventLifecycle(virConnectPtr conn, + virDomainPtr dom, + int event, + int detail, + void *opaque) { virNetServerClientPtr client = opaque; remote_domain_event_lifecycle_msg data; - if (!client) + if (!client || !remoteRelayDomainEventCheckACL(client, conn, dom)) return -1; VIR_DEBUG("Relaying domain lifecycle event %d %d", event, detail); @@ -141,14 +172,15 @@ static int remoteRelayDomainEventLifecycle(virConnectPtr conn ATTRIBUTE_UNUSED, return 0; } -static int remoteRelayDomainEventReboot(virConnectPtr conn ATTRIBUTE_UNUSED, - virDomainPtr dom, - void *opaque) +static int +remoteRelayDomainEventReboot(virConnectPtr conn, + virDomainPtr dom, + void *opaque) { virNetServerClientPtr client = opaque; remote_domain_event_reboot_msg data; - if (!client) + if (!client || !remoteRelayDomainEventCheckACL(client, conn, dom)) return -1; VIR_DEBUG("Relaying domain reboot event %s %d", dom->name, dom->id); @@ -165,15 +197,16 @@ static int remoteRelayDomainEventReboot(virConnectPtr conn ATTRIBUTE_UNUSED, } -static int remoteRelayDomainEventRTCChange(virConnectPtr conn ATTRIBUTE_UNUSED, - virDomainPtr dom, - long long offset, - void *opaque) +static int +remoteRelayDomainEventRTCChange(virConnectPtr conn, + virDomainPtr dom, + long long offset, + void *opaque) { virNetServerClientPtr client = opaque; remote_domain_event_rtc_change_msg data; - if (!client) + if (!client || !remoteRelayDomainEventCheckACL(client, conn, dom)) return -1; VIR_DEBUG("Relaying domain rtc change event %s %d %lld", dom->name, dom->id, offset); @@ -191,15 +224,16 @@ static int remoteRelayDomainEventRTCChange(virConnectPtr conn ATTRIBUTE_UNUSED, } -static int remoteRelayDomainEventWatchdog(virConnectPtr conn ATTRIBUTE_UNUSED, - virDomainPtr dom, - int action, - void *opaque) +static int +remoteRelayDomainEventWatchdog(virConnectPtr conn, + virDomainPtr dom, + int action, + void *opaque) { virNetServerClientPtr client = opaque; remote_domain_event_watchdog_msg data; - if (!client) + if (!client || !remoteRelayDomainEventCheckACL(client, conn, dom)) return -1; VIR_DEBUG("Relaying domain watchdog event %s %d %d", dom->name, dom->id, action); @@ -217,17 +251,18 @@ static int remoteRelayDomainEventWatchdog(virConnectPtr conn ATTRIBUTE_UNUSED, } -static int remoteRelayDomainEventIOError(virConnectPtr conn ATTRIBUTE_UNUSED, - virDomainPtr dom, - const char *srcPath, - const char *devAlias, - int action, - void *opaque) +static int +remoteRelayDomainEventIOError(virConnectPtr conn, + virDomainPtr dom, + const char *srcPath, + const char *devAlias, + int action, + void *opaque) { virNetServerClientPtr client = opaque; remote_domain_event_io_error_msg data; - if (!client) + if (!client || !remoteRelayDomainEventCheckACL(client, conn, dom)) return -1; VIR_DEBUG("Relaying domain io error %s %d %s %s %d", dom->name, dom->id, srcPath, devAlias, action); @@ -252,18 +287,19 @@ error: } -static int remoteRelayDomainEventIOErrorReason(virConnectPtr conn ATTRIBUTE_UNUSED, - virDomainPtr dom, - const char *srcPath, - const char *devAlias, - int action, - const char *reason, - void *opaque) +static int +remoteRelayDomainEventIOErrorReason(virConnectPtr conn, + virDomainPtr dom, + const char *srcPath, + const char *devAlias, + int action, + const char *reason, + void *opaque) { virNetServerClientPtr client = opaque; remote_domain_event_io_error_reason_msg data; - if (!client) + if (!client || !remoteRelayDomainEventCheckACL(client, conn, dom)) return -1; VIR_DEBUG("Relaying domain io error %s %d %s %s %d %s", @@ -293,20 +329,21 @@ error: } -static int remoteRelayDomainEventGraphics(virConnectPtr conn ATTRIBUTE_UNUSED, - virDomainPtr dom, - int phase, - virDomainEventGraphicsAddressPtr local, - virDomainEventGraphicsAddressPtr remote, - const char *authScheme, - virDomainEventGraphicsSubjectPtr subject, - void *opaque) +static int +remoteRelayDomainEventGraphics(virConnectPtr conn, + virDomainPtr dom, + int phase, + virDomainEventGraphicsAddressPtr local, + virDomainEventGraphicsAddressPtr remote, + const char *authScheme, + virDomainEventGraphicsSubjectPtr subject, + void *opaque) { virNetServerClientPtr client = opaque; remote_domain_event_graphics_msg data; size_t i; - if (!client) + if (!client || !remoteRelayDomainEventCheckACL(client, conn, dom)) return -1; VIR_DEBUG("Relaying domain graphics event %s %d %d - %d %s %s - %d %s %s - %s", dom->name, dom->id, phase, @@ -364,17 +401,18 @@ error: return -1; } -static int remoteRelayDomainEventBlockJob(virConnectPtr conn ATTRIBUTE_UNUSED, - virDomainPtr dom, - const char *path, - int type, - int status, - void *opaque) +static int +remoteRelayDomainEventBlockJob(virConnectPtr conn, + virDomainPtr dom, + const char *path, + int type, + int status, + void *opaque) { virNetServerClientPtr client = opaque; remote_domain_event_block_job_msg data; - if (!client) + if (!client || !remoteRelayDomainEventCheckACL(client, conn, dom)) return -1; VIR_DEBUG("Relaying domain block job event %s %d %s %i, %i", @@ -399,14 +437,15 @@ error: } -static int remoteRelayDomainEventControlError(virConnectPtr conn ATTRIBUTE_UNUSED, - virDomainPtr dom, - void *opaque) +static int +remoteRelayDomainEventControlError(virConnectPtr conn, + virDomainPtr dom, + void *opaque) { virNetServerClientPtr client = opaque; remote_domain_event_control_error_msg data; - if (!client) + if (!client || !remoteRelayDomainEventCheckACL(client, conn, dom)) return -1; VIR_DEBUG("Relaying domain control error %s %d", dom->name, dom->id); @@ -423,19 +462,20 @@ static int remoteRelayDomainEventControlError(virConnectPtr conn ATTRIBUTE_UNUSE } -static int remoteRelayDomainEventDiskChange(virConnectPtr conn ATTRIBUTE_UNUSED, - virDomainPtr dom, - const char *oldSrcPath, - const char *newSrcPath, - const char *devAlias, - int reason, - void *opaque) +static int +remoteRelayDomainEventDiskChange(virConnectPtr conn, + virDomainPtr dom, + const char *oldSrcPath, + const char *newSrcPath, + const char *devAlias, + int reason, + void *opaque) { virNetServerClientPtr client = opaque; remote_domain_event_disk_change_msg data; char **oldSrcPath_p = NULL, **newSrcPath_p = NULL; - if (!client) + if (!client || !remoteRelayDomainEventCheckACL(client, conn, dom)) return -1; VIR_DEBUG("Relaying domain %s %d disk change %s %s %s %d", @@ -474,15 +514,17 @@ error: } -static int remoteRelayDomainEventTrayChange(virConnectPtr conn ATTRIBUTE_UNUSED, - virDomainPtr dom, - const char *devAlias, - int reason, - void *opaque) { +static int +remoteRelayDomainEventTrayChange(virConnectPtr conn, + virDomainPtr dom, + const char *devAlias, + int reason, + void *opaque) +{ virNetServerClientPtr client = opaque; remote_domain_event_tray_change_msg data; - if (!client) + if (!client || !remoteRelayDomainEventCheckACL(client, conn, dom)) return -1; VIR_DEBUG("Relaying domain %s %d tray change devAlias: %s reason: %d", @@ -504,14 +546,16 @@ static int remoteRelayDomainEventTrayChange(virConnectPtr conn ATTRIBUTE_UNUSED, return 0; } -static int remoteRelayDomainEventPMWakeup(virConnectPtr conn ATTRIBUTE_UNUSED, - virDomainPtr dom, - int reason ATTRIBUTE_UNUSED, - void *opaque) { +static int +remoteRelayDomainEventPMWakeup(virConnectPtr conn, + virDomainPtr dom, + int reason ATTRIBUTE_UNUSED, + void *opaque) +{ virNetServerClientPtr client = opaque; remote_domain_event_pmwakeup_msg data; - if (!client) + if (!client || !remoteRelayDomainEventCheckACL(client, conn, dom)) return -1; VIR_DEBUG("Relaying domain %s %d system pmwakeup", dom->name, dom->id); @@ -527,14 +571,16 @@ static int remoteRelayDomainEventPMWakeup(virConnectPtr conn ATTRIBUTE_UNUSED, return 0; } -static int remoteRelayDomainEventPMSuspend(virConnectPtr conn ATTRIBUTE_UNUSED, - virDomainPtr dom, - int reason ATTRIBUTE_UNUSED, - void *opaque) { +static int +remoteRelayDomainEventPMSuspend(virConnectPtr conn, + virDomainPtr dom, + int reason ATTRIBUTE_UNUSED, + void *opaque) +{ virNetServerClientPtr client = opaque; remote_domain_event_pmsuspend_msg data; - if (!client) + if (!client || !remoteRelayDomainEventCheckACL(client, conn, dom)) return -1; VIR_DEBUG("Relaying domain %s %d system pmsuspend", dom->name, dom->id); @@ -551,7 +597,7 @@ static int remoteRelayDomainEventPMSuspend(virConnectPtr conn ATTRIBUTE_UNUSED, } static int -remoteRelayDomainEventBalloonChange(virConnectPtr conn ATTRIBUTE_UNUSED, +remoteRelayDomainEventBalloonChange(virConnectPtr conn, virDomainPtr dom, unsigned long long actual, void *opaque) @@ -559,7 +605,7 @@ remoteRelayDomainEventBalloonChange(virConnectPtr conn ATTRIBUTE_UNUSED, virNetServerClientPtr client = opaque; remote_domain_event_balloon_change_msg data; - if (!client) + if (!client || !remoteRelayDomainEventCheckACL(client, conn, dom)) return -1; VIR_DEBUG("Relaying domain balloon change event %s %d %lld", dom->name, dom->id, actual); @@ -577,14 +623,16 @@ remoteRelayDomainEventBalloonChange(virConnectPtr conn ATTRIBUTE_UNUSED, } -static int remoteRelayDomainEventPMSuspendDisk(virConnectPtr conn ATTRIBUTE_UNUSED, - virDomainPtr dom, - int reason ATTRIBUTE_UNUSED, - void *opaque) { +static int +remoteRelayDomainEventPMSuspendDisk(virConnectPtr conn, + virDomainPtr dom, + int reason ATTRIBUTE_UNUSED, + void *opaque) +{ virNetServerClientPtr client = opaque; remote_domain_event_pmsuspend_disk_msg data; - if (!client) + if (!client || !remoteRelayDomainEventCheckACL(client, conn, dom)) return -1; VIR_DEBUG("Relaying domain %s %d system pmsuspend-disk", dom->name, dom->id); @@ -601,7 +649,7 @@ static int remoteRelayDomainEventPMSuspendDisk(virConnectPtr conn ATTRIBUTE_UNUS } static int -remoteRelayDomainEventDeviceRemoved(virConnectPtr conn ATTRIBUTE_UNUSED, +remoteRelayDomainEventDeviceRemoved(virConnectPtr conn, virDomainPtr dom, const char *devAlias, void *opaque) @@ -609,7 +657,7 @@ remoteRelayDomainEventDeviceRemoved(virConnectPtr conn ATTRIBUTE_UNUSED, virNetServerClientPtr client = opaque; remote_domain_event_device_removed_msg data; - if (!client) + if (!client || !remoteRelayDomainEventCheckACL(client, conn, dom)) return -1; VIR_DEBUG("Relaying domain device removed event %s %d %s", diff --git a/src/access/viraccessperm.h b/src/access/viraccessperm.h index fdc461b..1036b08 100644 --- a/src/access/viraccessperm.h +++ b/src/access/viraccessperm.h @@ -1,7 +1,7 @@ /* * viraccessperm.h: access control permissions * - * Copyright (C) 2012-2013 Red Hat, Inc. + * Copyright (C) 2012-2014 Red Hat, Inc. * * This library is free software; you can redistribute it and/or * modify it under the terms of the GNU Lesser General Public @@ -47,7 +47,7 @@ typedef enum { /** * @desc: List domains - * @message: Listing domains requires authorization + * @message: Listing domains or using domain events requires authorization * @anonymous: 1 */ VIR_ACCESS_PERM_CONNECT_SEARCH_DOMAINS, diff --git a/src/check-aclrules.pl b/src/check-aclrules.pl index 057517e..f54b934 100644 --- a/src/check-aclrules.pl +++ b/src/check-aclrules.pl @@ -1,6 +1,6 @@ #!/usr/bin/perl # -# Copyright (C) 2013 Red Hat, Inc. +# Copyright (C) 2013-2014 Red Hat, Inc. # # This library is free software; you can redistribute it and/or # modify it under the terms of the GNU Lesser General Public @@ -140,7 +140,10 @@ while (<PROTO>) { } elsif ($filtered && m,REMOTE_PROC_(.*)\s+=\s*\d+,) { my $api = name_to_ProcName($1); - $filtered{$api} = 1; + # Event filtering is handled in daemon/remote.c instead of drivers + if (! m,_EVENT_REGISTER,) { + $filtered{$api} = 1; + } $incomment = 0; } } diff --git a/src/remote/remote_protocol.x b/src/remote/remote_protocol.x index f942670..8c40208 100644 --- a/src/remote/remote_protocol.x +++ b/src/remote/remote_protocol.x @@ -1955,7 +1955,7 @@ struct remote_node_device_destroy_args { /* * Events Register/Deregister: - * It would seem rpcgen does not like both args, and ret + * It would seem rpcgen does not like both args and ret * to be null. It will not generate the prototype otherwise. * Pass back a redundant boolean to force prototype generation. */ @@ -3620,7 +3620,8 @@ enum remote_procedure { /** * @generate: none * @priority: high - * @acl: connect:read + * @acl: connect:search_domains + * @aclfilter: domain:getattr */ REMOTE_PROC_CONNECT_DOMAIN_EVENT_REGISTER = 105, @@ -4052,7 +4053,8 @@ enum remote_procedure { /** * @generate: none * @priority: high - * @acl: connect:read + * @acl: connect:search_domains + * @aclfilter: domain:getattr */ REMOTE_PROC_CONNECT_DOMAIN_EVENT_REGISTER_ANY = 167, -- 1.8.5.3
On 01/28/2014 03:48 PM, Eric Blake wrote:
Commit f9f56340 for CVE-2014-0028 almost had the right idea - we need to check the ACL rules to filter which events to send. But it overlooked one thing: the event dispatch queue is running in the main loop thread, and therefore does not normally have a current virIdentityPtr. But filter checks can be based on current identity, so when libvirtd.conf contains access_drivers=["polkit"], we ended up rejecting access for EVERY event due to failure to look up the current identity, even if it should have been allowed.
Ping. -- Eric Blake eblake redhat com +1-919-301-3266 Libvirt virtualization library http://libvirt.org
On Tue, Jan 28, 2014 at 03:48:19PM -0700, Eric Blake wrote:
Commit f9f56340 for CVE-2014-0028 almost had the right idea - we need to check the ACL rules to filter which events to send. But it overlooked one thing: the event dispatch queue is running in the main loop thread, and therefore does not normally have a current virIdentityPtr. But filter checks can be based on current identity, so when libvirtd.conf contains access_drivers=["polkit"], we ended up rejecting access for EVERY event due to failure to look up the current identity, even if it should have been allowed.
Furthermore, even for events that are triggered by API calls, it is important to remember that the point of events is that they can be copied across multiple connections, which may have separate identities and permissions. So even if events were dispatched from a context where we have an identity, we must change to the correct identity of the connection that will be receiving the event, rather than basing a decision on the context that triggered the event, when deciding whether to filter an event to a particular connection.
If there were an easy way to get from virConnectPtr to the appropriate virIdentityPtr, then object_event.c could adjust the identity prior to checking whether to dispatch an event. But setting up that back-reference is a bit invasive. Instead, it is easier to delay the filtering check until lower down the stack, at the point where we have direct access to the RPC client object that owns an identity. As such, this patch ends up reverting a large portion of the framework of commit f9f56340. We also have to teach 'make check' to special-case the fact that the event registration filtering is done at the point of dispatch, rather than the point of registration. Note that even though we don't actually use virConnectDomainEventRegisterCheckACL (because the RegisterAny variant is sufficient), we still generate the function for the purposes of documenting that the filtering takes place.
Also note that I did not entirely delete the notion of a filter from object_event.c; I still plan on using that for my upcoming patch series for qemu monitor events in libvirt-qemu.so. In other words, while this patch changes ACL filtering to live in remote.c and therefore we have no current client of the filtering in object_event.c, the notion of filtering in object_event.c is still useful down the road.
* src/check-aclrules.pl: Exempt event registration from having to pass checkACL filter down call stack. * daemon/remote.c (remoteRelayDomainEventCheckACL) (remoteRelayNetworkEventCheckACL): New functions. (remoteRelay*Event*): Use new functions. * src/conf/domain_event.h (virDomainEventStateRegister) (virDomainEventStateRegisterID): Drop unused parameter. * src/conf/network_event.h (virNetworkEventStateRegisterID): Likewise. * src/conf/domain_event.c (virDomainEventFilter): Delete unused function. * src/conf/network_event.c (virNetworkEventFilter): Likewise. * src/libxl/libxl_driver.c: Adjust caller. * src/lxc/lxc_driver.c: Likewise. * src/network/bridge_driver.c: Likewise. * src/qemu/qemu_driver.c: Likewise. * src/remote/remote_driver.c: Likewise. * src/test/test_driver.c: Likewise. * src/uml/uml_driver.c: Likewise. * src/vbox/vbox_tmpl.c: Likewise. * src/xen/xen_driver.c: Likewise.
Signed-off-by: Eric Blake <eblake@redhat.com> --- daemon/remote.c | 257 ++++++++++++++++++++++++++++---------------- src/check-aclrules.pl | 7 +- src/conf/domain_event.c | 35 +----- src/conf/domain_event.h | 8 +- src/conf/network_event.c | 31 +----- src/conf/network_event.h | 6 +- src/libxl/libxl_driver.c | 2 - src/lxc/lxc_driver.c | 2 - src/network/bridge_driver.c | 1 - src/qemu/qemu_driver.c | 2 - src/remote/remote_driver.c | 4 +- src/test/test_driver.c | 6 +- src/uml/uml_driver.c | 2 - src/vbox/vbox_tmpl.c | 4 +- src/xen/xen_driver.c | 2 - 15 files changed, 188 insertions(+), 181 deletions(-)
ACK Daniel -- |: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :| |: http://libvirt.org -o- http://virt-manager.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: http://entangle-photo.org -o- http://live.gnome.org/gtk-vnc :|
On 02/05/2014 06:56 AM, Daniel P. Berrange wrote:
On Tue, Jan 28, 2014 at 03:48:19PM -0700, Eric Blake wrote:
Commit f9f56340 for CVE-2014-0028 almost had the right idea - we need to check the ACL rules to filter which events to send. But it overlooked one thing: the event dispatch queue is running in the main loop thread, and therefore does not normally have a current virIdentityPtr. But filter checks can be based on current identity, so when libvirtd.conf contains access_drivers=["polkit"], we ended up rejecting access for EVERY event due to failure to look up the current identity, even if it should have been allowed.
ACK
Thanks; I've updated the commit message to mention https://bugzilla.redhat.com/show_bug.cgi?id=1058839, and will have the backport pushed to all affected maint branches shortly. -- Eric Blake eblake redhat com +1-919-301-3266 Libvirt virtualization library http://libvirt.org
participants (2)
-
Daniel P. Berrange -
Eric Blake