[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PULL 11/31] docs: replace insecure /tmp examples in qsd docs
From: |
Kevin Wolf |
Subject: |
[PULL 11/31] docs: replace insecure /tmp examples in qsd docs |
Date: |
Fri, 5 Mar 2021 17:54:34 +0100 |
From: Stefan Hajnoczi <stefanha@redhat.com>
World-writeable directories have security issues. Avoid showing them in
the documentation since someone might accidentally use them in
situations where they are insecure.
There tend to be 3 security problems:
1. Denial of service. An adversary may be able to create the file
beforehand, consume all space/inodes, etc to sabotage us.
2. Impersonation. An adversary may be able to create a listen socket and
accept incoming connections that were meant for us.
3. Unauthenticated client access. An adversary may be able to connect to
us if we did not set the uid/gid and permissions correctly.
These can be prevented or mitigated with private /tmp, carefully setting
the umask, etc but that requires special action and does not apply to
all situations. Just avoid using /tmp in examples.
Reported-by: Richard W.M. Jones <rjones@redhat.com>
Reported-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-Id: <20210301172728.135331-3-stefanha@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Richard W.M. Jones <rjones@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
docs/tools/qemu-storage-daemon.rst | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/docs/tools/qemu-storage-daemon.rst
b/docs/tools/qemu-storage-daemon.rst
index 5714794775..fe3042d609 100644
--- a/docs/tools/qemu-storage-daemon.rst
+++ b/docs/tools/qemu-storage-daemon.rst
@@ -69,7 +69,7 @@ Standard options:
a description of character device properties. A common character device
definition configures a UNIX domain socket::
- --chardev socket,id=char1,path=/tmp/qmp.sock,server=on,wait=off
+ --chardev socket,id=char1,path=/var/run/qsd-qmp.sock,server=on,wait=off
.. option:: --export
[type=]nbd,id=<id>,node-name=<node-name>[,name=<export-name>][,writable=on|off][,bitmap=<name>]
--export
[type=]vhost-user-blk,id=<id>,node-name=<node-name>,addr.type=unix,addr.path=<socket-path>[,writable=on|off][,logical-block-size=<block-size>][,num-queues=<num-queues>]
@@ -108,9 +108,10 @@ Standard options:
below). TLS encryption can be configured using ``--object`` tls-creds-* and
authz-* secrets (see below).
- To configure an NBD server on UNIX domain socket path ``/tmp/nbd.sock``::
+ To configure an NBD server on UNIX domain socket path
+ ``/var/run/qsd-nbd.sock``::
- --nbd-server addr.type=unix,addr.path=/tmp/nbd.sock
+ --nbd-server addr.type=unix,addr.path=/var/run/qsd-nbd.sock
.. option:: --object help
--object <type>,help
--
2.29.2
- [PULL 00/31] Block layer patches, Kevin Wolf, 2021/03/05
- [PULL 06/31] blockjob: report a better error message, Kevin Wolf, 2021/03/05
- [PULL 01/31] iotests: Drop deprecated 'props' from object-add, Kevin Wolf, 2021/03/05
- [PULL 15/31] libqtest: add qtest_remove_abrt_handler(), Kevin Wolf, 2021/03/05
- [PULL 13/31] libqtest: add qtest_socket_server(), Kevin Wolf, 2021/03/05
- [PULL 08/31] storage-daemon: include current command line option in the errors, Kevin Wolf, 2021/03/05
- [PULL 05/31] iotests: Fix up python style in 300, Kevin Wolf, 2021/03/05
- [PULL 09/31] qemu-storage-daemon: add --pidfile option, Kevin Wolf, 2021/03/05
- [PULL 02/31] backup: Remove nodes from job in .clean(), Kevin Wolf, 2021/03/05
- [PULL 26/31] block/parallels: BDRVParallelsState: add cluster_size field, Kevin Wolf, 2021/03/05
- [PULL 11/31] docs: replace insecure /tmp examples in qsd docs,
Kevin Wolf <=
- [PULL 19/31] block/export: use VIRTIO_BLK_SECTOR_BITS, Kevin Wolf, 2021/03/05
- [PULL 25/31] parallels.txt: fix bitmap L1 table description, Kevin Wolf, 2021/03/05
- [PULL 10/31] docs: show how to spawn qemu-storage-daemon with fd passing, Kevin Wolf, 2021/03/05
- [PULL 20/31] block/export: fix vhost-user-blk export sector number calculation, Kevin Wolf, 2021/03/05
- [PULL 17/31] tests/qtest: add multi-queue test case to vhost-user-blk-test, Kevin Wolf, 2021/03/05
- [PULL 21/31] block/export: port virtio-blk discard/write zeroes input validation, Kevin Wolf, 2021/03/05
- [PULL 23/31] block/export: port virtio-blk read/write range check, Kevin Wolf, 2021/03/05
- [PULL 03/31] backup-top: Refuse I/O in inactive state, Kevin Wolf, 2021/03/05
- [PULL 30/31] MAINTAINERS: update parallels block driver, Kevin Wolf, 2021/03/05
- [PULL 31/31] docs: qsd: Explain --export nbd,name=... default, Kevin Wolf, 2021/03/05