mirror of https://github.com/proxmox/mirror_qemu
![]() In order to prevent /proc/self/fd escapes a temporary directory is
created where /proc/self/fd is bind-mounted. This doesn't work on
read-only file systems.
Avoid the temporary directory by bind-mounting /proc/self/fd over /proc.
This does not affect other processes since we remounted / with MS_REC |
MS_SLAVE. /proc must exist and virtiofsd does not use it so it's safe to
do this.
Path traversal can be tested with the following function:
static void test_proc_fd_escape(struct lo_data *lo)
{
int fd;
int level = 0;
ino_t last_ino = 0;
fd = lo->proc_self_fd;
for (;;) {
struct stat st;
if (fstat(fd, &st) != 0) {
perror("fstat");
return;
}
if (last_ino && st.st_ino == last_ino) {
fprintf(stderr, "inode number unchanged, stopping\n");
return;
}
last_ino = st.st_ino;
fprintf(stderr, "Level %d dev %lu ino %lu\n", level,
(unsigned long)st.st_dev,
(unsigned long)last_ino);
fd = openat(fd, "..", O_PATH | O_DIRECTORY | O_NOFOLLOW);
level++;
}
}
Before and after this patch only Level 0 is displayed. Without
/proc/self/fd bind-mount protection it is possible to traverse parent
directories.
Fixes:
|
||
---|---|---|
.. | ||
50-qemu-virtiofsd.json.in | ||
buffer.c | ||
fuse_common.h | ||
fuse_i.h | ||
fuse_log.c | ||
fuse_log.h | ||
fuse_lowlevel.c | ||
fuse_lowlevel.h | ||
fuse_misc.h | ||
fuse_opt.c | ||
fuse_opt.h | ||
fuse_signals.c | ||
fuse_virtio.c | ||
fuse_virtio.h | ||
helper.c | ||
meson.build | ||
passthrough_helpers.h | ||
passthrough_ll.c | ||
passthrough_seccomp.c | ||
passthrough_seccomp.h |