[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PULL 054/108] virtiofsd: cap-ng helpers
From: |
Dr. David Alan Gilbert (git) |
Subject: |
[PULL 054/108] virtiofsd: cap-ng helpers |
Date: |
Thu, 23 Jan 2020 16:45:36 +0000 |
From: "Dr. David Alan Gilbert" <address@hidden>
libcap-ng reads /proc during capng_get_caps_process, and virtiofsd's
sandboxing doesn't have /proc mounted; thus we have to do the
caps read before we sandbox it and save/restore the state.
Signed-off-by: Dr. David Alan Gilbert <address@hidden>
Reviewed-by: Daniel P. Berrangé <address@hidden>
Signed-off-by: Dr. David Alan Gilbert <address@hidden>
---
Makefile | 4 +-
tools/virtiofsd/passthrough_ll.c | 72 ++++++++++++++++++++++++++++++++
2 files changed, 74 insertions(+), 2 deletions(-)
diff --git a/Makefile b/Makefile
index ad400f36b2..6b4b075a92 100644
--- a/Makefile
+++ b/Makefile
@@ -327,7 +327,7 @@ HELPERS-y += vhost-user-gpu$(EXESUF)
vhost-user-json-y += contrib/vhost-user-gpu/50-qemu-gpu.json
endif
-ifeq ($(CONFIG_LINUX)$(CONFIG_SECCOMP),yy)
+ifeq ($(CONFIG_LINUX)$(CONFIG_SECCOMP)$(CONFIG_LIBCAP_NG),yyy)
HELPERS-y += virtiofsd$(EXESUF)
vhost-user-json-y += tools/virtiofsd/50-qemu-virtiofsd.json
endif
@@ -675,7 +675,7 @@ rdmacm-mux$(EXESUF): $(rdmacm-mux-obj-y) $(COMMON_LDADDS)
$(call LINK, $^)
# relies on Linux-specific syscalls
-ifeq ($(CONFIG_LINUX)$(CONFIG_SECCOMP),yy)
+ifeq ($(CONFIG_LINUX)$(CONFIG_SECCOMP)$(CONFIG_LIBCAP_NG),yyy)
virtiofsd$(EXESUF): $(virtiofsd-obj-y) libvhost-user.a $(COMMON_LDADDS)
$(call LINK, $^)
endif
diff --git a/tools/virtiofsd/passthrough_ll.c b/tools/virtiofsd/passthrough_ll.c
index bd8925bd83..97e7c75667 100644
--- a/tools/virtiofsd/passthrough_ll.c
+++ b/tools/virtiofsd/passthrough_ll.c
@@ -39,6 +39,7 @@
#include "fuse_virtio.h"
#include "fuse_lowlevel.h"
#include <assert.h>
+#include <cap-ng.h>
#include <dirent.h>
#include <errno.h>
#include <inttypes.h>
@@ -139,6 +140,13 @@ static const struct fuse_opt lo_opts[] = {
static void unref_inode(struct lo_data *lo, struct lo_inode *inode, uint64_t
n);
+static struct {
+ pthread_mutex_t mutex;
+ void *saved;
+} cap;
+/* That we loaded cap-ng in the current thread from the saved */
+static __thread bool cap_loaded = 0;
+
static struct lo_inode *lo_find(struct lo_data *lo, struct stat *st);
static int is_dot_or_dotdot(const char *name)
@@ -162,6 +170,37 @@ static struct lo_data *lo_data(fuse_req_t req)
return (struct lo_data *)fuse_req_userdata(req);
}
+/*
+ * Load capng's state from our saved state if the current thread
+ * hadn't previously been loaded.
+ * returns 0 on success
+ */
+static int load_capng(void)
+{
+ if (!cap_loaded) {
+ pthread_mutex_lock(&cap.mutex);
+ capng_restore_state(&cap.saved);
+ /*
+ * restore_state free's the saved copy
+ * so make another.
+ */
+ cap.saved = capng_save_state();
+ if (!cap.saved) {
+ fuse_log(FUSE_LOG_ERR, "capng_save_state (thread)\n");
+ return -EINVAL;
+ }
+ pthread_mutex_unlock(&cap.mutex);
+
+ /*
+ * We want to use the loaded state for our pid,
+ * not the original
+ */
+ capng_setpid(syscall(SYS_gettid));
+ cap_loaded = true;
+ }
+ return 0;
+}
+
static void lo_map_init(struct lo_map *map)
{
map->elems = NULL;
@@ -2023,6 +2062,35 @@ static void setup_namespaces(struct lo_data *lo, struct
fuse_session *se)
}
}
+/*
+ * Capture the capability state, we'll need to restore this for individual
+ * threads later; see load_capng.
+ */
+static void setup_capng(void)
+{
+ /* Note this accesses /proc so has to happen before the sandbox */
+ if (capng_get_caps_process()) {
+ fuse_log(FUSE_LOG_ERR, "capng_get_caps_process\n");
+ exit(1);
+ }
+ pthread_mutex_init(&cap.mutex, NULL);
+ pthread_mutex_lock(&cap.mutex);
+ cap.saved = capng_save_state();
+ if (!cap.saved) {
+ fuse_log(FUSE_LOG_ERR, "capng_save_state\n");
+ exit(1);
+ }
+ pthread_mutex_unlock(&cap.mutex);
+}
+
+static void cleanup_capng(void)
+{
+ free(cap.saved);
+ cap.saved = NULL;
+ pthread_mutex_destroy(&cap.mutex);
+}
+
+
/*
* Make the source directory our root so symlinks cannot escape and no other
* files are accessible. Assumes unshare(CLONE_NEWNS) was already called.
@@ -2216,12 +2284,16 @@ int main(int argc, char *argv[])
fuse_daemonize(opts.foreground);
+ /* Must be before sandbox since it wants /proc */
+ setup_capng();
+
setup_sandbox(&lo, se);
/* Block until ctrl+c or fusermount -u */
ret = virtio_loop(se);
fuse_session_unmount(se);
+ cleanup_capng();
err_out3:
fuse_remove_signal_handlers(se);
err_out2:
--
2.24.1
- [PULL 039/108] virtiofsd: passthrough_ll: add fallback for racy ops, (continued)
- [PULL 039/108] virtiofsd: passthrough_ll: add fallback for racy ops, Dr. David Alan Gilbert (git), 2020/01/23
- [PULL 042/108] virtiofsd: Pass write iov's all the way through, Dr. David Alan Gilbert (git), 2020/01/23
- [PULL 047/108] virtiofsd: prevent ".." escape in lo_do_readdir(), Dr. David Alan Gilbert (git), 2020/01/23
- [PULL 048/108] virtiofsd: use /proc/self/fd/ O_PATH file descriptor, Dr. David Alan Gilbert (git), 2020/01/23
- [PULL 049/108] virtiofsd: sandbox mount namespace, Dr. David Alan Gilbert (git), 2020/01/23
- [PULL 045/108] virtiofsd: check input buffer size in fuse_lowlevel.c ops, Dr. David Alan Gilbert (git), 2020/01/23
- [PULL 050/108] virtiofsd: move to an empty network namespace, Dr. David Alan Gilbert (git), 2020/01/23
- [PULL 051/108] virtiofsd: move to a new pid namespace, Dr. David Alan Gilbert (git), 2020/01/23
- [PULL 053/108] virtiofsd: Parse flag FUSE_WRITE_KILL_PRIV, Dr. David Alan Gilbert (git), 2020/01/23
- [PULL 052/108] virtiofsd: add seccomp whitelist, Dr. David Alan Gilbert (git), 2020/01/23
- [PULL 054/108] virtiofsd: cap-ng helpers,
Dr. David Alan Gilbert (git) <=
- [PULL 056/108] virtiofsd: set maximum RLIMIT_NOFILE limit, Dr. David Alan Gilbert (git), 2020/01/23
- [PULL 057/108] virtiofsd: fix libfuse information leaks, Dr. David Alan Gilbert (git), 2020/01/23
- [PULL 055/108] virtiofsd: Drop CAP_FSETID if client asked for it, Dr. David Alan Gilbert (git), 2020/01/23
- [PULL 058/108] virtiofsd: add --syslog command-line option, Dr. David Alan Gilbert (git), 2020/01/23
- [PULL 059/108] virtiofsd: print log only when priority is high enough, Dr. David Alan Gilbert (git), 2020/01/23
- [PULL 063/108] virtiofsd: Handle hard reboot, Dr. David Alan Gilbert (git), 2020/01/23
- [PULL 064/108] virtiofsd: Kill threads when queues are stopped, Dr. David Alan Gilbert (git), 2020/01/23
- [PULL 060/108] virtiofsd: Add ID to the log with FUSE_LOG_DEBUG level, Dr. David Alan Gilbert (git), 2020/01/23
- [PULL 067/108] virtiofsd: passthrough_ll: add renameat2 support, Dr. David Alan Gilbert (git), 2020/01/23
- [PULL 061/108] virtiofsd: Add timestamp to the log with FUSE_LOG_DEBUG level, Dr. David Alan Gilbert (git), 2020/01/23