diff options
author | Ján Tomko <jtomko@redhat.com> | 2019-06-14 08:47:42 +0200 |
---|---|---|
committer | Ján Tomko <jtomko@redhat.com> | 2019-06-24 09:35:48 +0200 |
commit | 3d9c8914663549e0cc0e822fa29b0a3a5bbc0fbd (patch) | |
tree | 6a8f72a9c5cfe6169005ac36d65a3c8653dc728a | |
parent | c909c8e185a14bbab82564f219c0bb492a81ca43 (diff) | |
download | libvirt-3d9c8914663549e0cc0e822fa29b0a3a5bbc0fbd.tar.gz |
api: disallow virDomainSaveImageGetXMLDesc on read-only connections
The virDomainSaveImageGetXMLDesc API is taking a path parameter,
which can point to any path on the system. This file will then be
read and parsed by libvirtd running with root privileges.
Forbid it on read-only connections.
Fixes: CVE-2019-10161
Reported-by: Matthias Gerstner <mgerstner@suse.de>
Signed-off-by: Ján Tomko <jtomko@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
(cherry picked from commit aed6a032cead4386472afb24b16196579e239580)
Signed-off-by: Ján Tomko <jtomko@redhat.com>
-rw-r--r-- | src/libvirt-domain.c | 11 | ||||
-rw-r--r-- | src/qemu/qemu_driver.c | 2 | ||||
-rw-r--r-- | src/remote/remote_protocol.x | 3 |
3 files changed, 4 insertions, 12 deletions
diff --git a/src/libvirt-domain.c b/src/libvirt-domain.c index be5b1f6740..4279b9425c 100644 --- a/src/libvirt-domain.c +++ b/src/libvirt-domain.c @@ -1073,8 +1073,7 @@ virDomainRestoreFlags(virConnectPtr conn, const char *from, const char *dxml, * previously by virDomainSave() or virDomainSaveFlags(). * * No security-sensitive data will be included unless @flags contains - * VIR_DOMAIN_SAVE_IMAGE_XML_SECURE; this flag is rejected on read-only - * connections. + * VIR_DOMAIN_SAVE_IMAGE_XML_SECURE. * * Returns a 0 terminated UTF-8 encoded XML instance, or NULL in case of * error. The caller must free() the returned value. @@ -1090,13 +1089,7 @@ virDomainSaveImageGetXMLDesc(virConnectPtr conn, const char *file, virCheckConnectReturn(conn, NULL); virCheckNonNullArgGoto(file, error); - - if ((conn->flags & VIR_CONNECT_RO) && - (flags & VIR_DOMAIN_SAVE_IMAGE_XML_SECURE)) { - virReportError(VIR_ERR_OPERATION_DENIED, "%s", - _("virDomainSaveImageGetXMLDesc with secure flag")); - goto error; - } + virCheckReadOnlyGoto(conn->flags, error); if (conn->driver->domainSaveImageGetXMLDesc) { char *ret; diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 62d8d977c5..a0c0e3c07d 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -7062,7 +7062,7 @@ qemuDomainSaveImageGetXMLDesc(virConnectPtr conn, const char *path, if (fd < 0) goto cleanup; - if (virDomainSaveImageGetXMLDescEnsureACL(conn, def, flags) < 0) + if (virDomainSaveImageGetXMLDescEnsureACL(conn, def) < 0) goto cleanup; ret = qemuDomainDefFormatXML(driver, def, flags); diff --git a/src/remote/remote_protocol.x b/src/remote/remote_protocol.x index 74be4b37d0..a0282ee940 100644 --- a/src/remote/remote_protocol.x +++ b/src/remote/remote_protocol.x @@ -5242,8 +5242,7 @@ enum remote_procedure { /** * @generate: both * @priority: high - * @acl: domain:read - * @acl: domain:read_secure:VIR_DOMAIN_SAVE_IMAGE_XML_SECURE + * @acl: domain:write */ REMOTE_PROC_DOMAIN_SAVE_IMAGE_GET_XML_DESC = 235, |