From nobody Tue Feb 10 09:57:54 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zoho.com; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 1493997760760117.82017473137762; Fri, 5 May 2017 08:22:40 -0700 (PDT) Received: from localhost ([::1]:47488 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1d6f3y-0002y3-Bo for importer@patchew.org; Fri, 05 May 2017 11:22:34 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:33917) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1d6f2a-0001mz-Ul for qemu-devel@nongnu.org; Fri, 05 May 2017 11:21:10 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1d6f2X-0001dZ-Mm for qemu-devel@nongnu.org; Fri, 05 May 2017 11:21:08 -0400 Received: from 18.mo5.mail-out.ovh.net ([178.33.45.10]:37126) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1d6f2X-0001d2-G9 for qemu-devel@nongnu.org; Fri, 05 May 2017 11:21:05 -0400 Received: from player786.ha.ovh.net (b6.ovh.net [213.186.33.56]) by mo5.mail-out.ovh.net (Postfix) with ESMTP id CA6CFDE7DB for ; Fri, 5 May 2017 17:21:03 +0200 (CEST) Received: from bahia.lan (gar31-1-82-66-74-139.fbx.proxad.net [82.66.74.139]) (Authenticated sender: groug@kaod.org) by player786.ha.ovh.net (Postfix) with ESMTPA id 9CDC38086C; Fri, 5 May 2017 16:37:38 +0200 (CEST) From: Greg Kurz To: qemu-devel@nongnu.org Date: Fri, 05 May 2017 16:37:38 +0200 Message-ID: <149399505841.29022.17760460736155165332.stgit@bahia.lan> In-Reply-To: <149399500677.29022.12340124231191204194.stgit@bahia.lan> References: <149399500677.29022.12340124231191204194.stgit@bahia.lan> User-Agent: StGit/0.17.1-20-gc0b1b-dirty MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Ovh-Tracer-Id: 10247096530046064968 X-VR-SPAMSTATE: OK X-VR-SPAMSCORE: -100 X-VR-SPAMCAUSE: gggruggvucftvghtrhhoucdtuddrfeeliedrieeggdeklecutefuodetggdotefrodftvfcurfhrohhfihhlvgemucfqggfjpdevjffgvefmvefgnecuuegrihhlohhuthemuceftddtnecusecvtfgvtghiphhivghnthhsucdlqddutddtmd X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-Received-From: 178.33.45.10 Subject: [Qemu-devel] [PATCH 5/5] 9pfs: local: forbid client access to metadata X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: =?utf-8?q?L=C3=A9o?= Gaspard , Greg Kurz Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail: RSF_0 Z_629925259 SPT_0 When using the mapped-file security mode, we shouldn't let the client mess with the metadata. The current code already hides it but the client can still access the metadata through several operations. This patch fixes the issue by: - preventing the creation of fids pointing to the metadata (name_to_path) - failing various operations taking a dirpath and a name arguments if name is a metadata reserved name Signed-off-by: Greg Kurz --- hw/9pfs/9p-local.c | 41 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 41 insertions(+) diff --git a/hw/9pfs/9p-local.c b/hw/9pfs/9p-local.c index b427d2928800..93cadac302c9 100644 --- a/hw/9pfs/9p-local.c +++ b/hw/9pfs/9p-local.c @@ -588,6 +588,11 @@ static int local_mknod(FsContext *fs_ctx, V9fsPath *di= r_path, int err =3D -1; int dirfd; =20 + if (local_must_skip_metadata(fs_ctx, name)) { + errno =3D EINVAL; + return -1; + } + dirfd =3D local_opendir_nofollow(fs_ctx, dir_path->data); if (dirfd =3D=3D -1) { return -1; @@ -634,6 +639,11 @@ static int local_mkdir(FsContext *fs_ctx, V9fsPath *di= r_path, int err =3D -1; int dirfd; =20 + if (local_must_skip_metadata(fs_ctx, name)) { + errno =3D EINVAL; + return -1; + } + dirfd =3D local_opendir_nofollow(fs_ctx, dir_path->data); if (dirfd =3D=3D -1) { return -1; @@ -723,6 +733,11 @@ static int local_open2(FsContext *fs_ctx, V9fsPath *di= r_path, const char *name, int err =3D -1; int dirfd; =20 + if (local_must_skip_metadata(fs_ctx, name)) { + errno =3D EINVAL; + return -1; + } + /* * Mark all the open to not follow symlinks */ @@ -781,6 +796,11 @@ static int local_symlink(FsContext *fs_ctx, const char= *oldpath, int err =3D -1; int dirfd; =20 + if (local_must_skip_metadata(fs_ctx, name)) { + errno =3D EINVAL; + return -1; + } + dirfd =3D local_opendir_nofollow(fs_ctx, dir_path->data); if (dirfd =3D=3D -1) { return -1; @@ -855,6 +875,11 @@ static int local_link(FsContext *ctx, V9fsPath *oldpat= h, int ret =3D -1; int odirfd, ndirfd; =20 + if (local_must_skip_metadata(ctx, name)) { + errno =3D EINVAL; + return -1; + } + odirfd =3D local_opendir_nofollow(ctx, odirpath); if (odirfd =3D=3D -1) { goto out; @@ -983,6 +1008,11 @@ static int local_unlinkat_common(FsContext *ctx, int = dirfd, const char *name, { int ret =3D -1; =20 + if (local_must_skip_metadata(ctx, name)) { + errno =3D EINVAL; + return -1; + } + if (ctx->export_flags & V9FS_SM_MAPPED_FILE) { int map_dirfd; =20 @@ -1125,6 +1155,11 @@ static int local_lremovexattr(FsContext *ctx, V9fsPa= th *fs_path, static int local_name_to_path(FsContext *ctx, V9fsPath *dir_path, const char *name, V9fsPath *target) { + if (local_must_skip_metadata(ctx, name)) { + errno =3D EINVAL; + return -1; + } + if (dir_path) { if (!strcmp(name, ".")) { /* "." relative to "foo/bar" is "foo/bar" */ @@ -1161,6 +1196,12 @@ static int local_renameat(FsContext *ctx, V9fsPath *= olddir, int ret; int odirfd, ndirfd; =20 + if (local_must_skip_metadata(ctx, old_name) || + local_must_skip_metadata(ctx, new_name)) { + errno =3D EINVAL; + return -1; + } + odirfd =3D local_opendir_nofollow(ctx, olddir->data); if (odirfd =3D=3D -1) { return -1;