From nobody Wed Feb 11 02:14:23 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zoho.com; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 1495550088187509.42511037985923; Tue, 23 May 2017 07:34:48 -0700 (PDT) Received: from localhost ([::1]:49367 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1dDAta-00048d-Kw for importer@patchew.org; Tue, 23 May 2017 10:34:46 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:46446) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1dDArl-0002wp-0v for qemu-devel@nongnu.org; Tue, 23 May 2017 10:32:57 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1dDArg-0008Lo-Oi for qemu-devel@nongnu.org; Tue, 23 May 2017 10:32:53 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]:49316 helo=mx0a-001b2d01.pphosted.com) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1dDArg-0008Lg-I1 for qemu-devel@nongnu.org; Tue, 23 May 2017 10:32:48 -0400 Received: from pps.filterd (m0098419.ppops.net [127.0.0.1]) by mx0b-001b2d01.pphosted.com (8.16.0.20/8.16.0.20) with SMTP id v4NETe8v017089 for ; Tue, 23 May 2017 10:32:47 -0400 Received: from e14.ny.us.ibm.com (e14.ny.us.ibm.com [129.33.205.204]) by mx0b-001b2d01.pphosted.com with ESMTP id 2amf9axqjn-1 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=NOT) for ; Tue, 23 May 2017 10:32:47 -0400 Received: from localhost by e14.ny.us.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Tue, 23 May 2017 10:32:47 -0400 Received: from b01cxnp23032.gho.pok.ibm.com (9.57.198.27) by e14.ny.us.ibm.com (146.89.104.201) with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted; Tue, 23 May 2017 10:32:43 -0400 Received: from b01ledav001.gho.pok.ibm.com (b01ledav001.gho.pok.ibm.com [9.57.199.106]) by b01cxnp23032.gho.pok.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id v4NEWiRj40567020; Tue, 23 May 2017 14:32:44 GMT Received: from b01ledav001.gho.pok.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 1DE3028041; Tue, 23 May 2017 10:32:38 -0400 (EDT) Received: from bahia.lab.toulouse-stg.fr.ibm.com (unknown [9.101.4.41]) by b01ledav001.gho.pok.ibm.com (Postfix) with ESMTP id 96F492803E; Tue, 23 May 2017 10:32:37 -0400 (EDT) From: Greg Kurz To: qemu-devel@nongnu.org Date: Tue, 23 May 2017 16:32:42 +0200 In-Reply-To: <149554993519.23396.2947622015408783770.stgit@bahia.lab.toulouse-stg.fr.ibm.com> References: <149554993519.23396.2947622015408783770.stgit@bahia.lab.toulouse-stg.fr.ibm.com> User-Agent: StGit/0.17.1-20-gc0b1b-dirty MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 x-cbid: 17052314-0052-0000-0000-00000208018A X-IBM-SpamModules-Scores: X-IBM-SpamModules-Versions: BY=3.00007106; HX=3.00000241; KW=3.00000007; PH=3.00000004; SC=3.00000212; SDB=6.00864511; UDB=6.00429167; IPR=6.00644291; BA=6.00005369; NDR=6.00000001; ZLA=6.00000005; ZF=6.00000009; ZB=6.00000000; ZP=6.00000000; ZH=6.00000000; ZU=6.00000002; MB=3.00015552; XFM=3.00000015; UTC=2017-05-23 14:32:45 X-IBM-AV-DETECTION: SAVI=unused REMOTE=unused XFE=unused x-cbparentid: 17052314-0053-0000-0000-000050AE6C95 Message-Id: <149554996230.23396.14573553304393992709.stgit@bahia.lab.toulouse-stg.fr.ibm.com> X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2017-05-23_04:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=1 malwarescore=0 phishscore=0 adultscore=1 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1703280000 definitions=main-1705230075 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x [generic] [fuzzy] X-Received-From: 148.163.158.5 Subject: [Qemu-devel] [PATCH v2 4/4] 9pfs: local: metadata file for the VirtFS root X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Leo Gaspard , Greg Kurz Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail: RSF_0 Z_629925259 SPT_0 When using the mapped-file security, credentials are stored in a metadata directory located in the parent directory. This is okay for all paths with the notable exception of the root path, since we don't want and probably can't create a metadata directory above the virtfs directory on the host. This patch introduces a dedicated metadata file, sitting in the virtfs root for this purpose. It relies on the fact that the "." name necessarily refers to the virtfs root. As for the metadata directory, we don't want the client to see this file. The current code only cares for readdir() but there are many other places to fix actually. The filtering logic is hence put in a separate function. Before: # ls -ld drwxr-xr-x. 3 greg greg 4096 May 5 12:49 . # chown root.root . chown: changing ownership of '.': Is a directory # ls -ld drwxr-xr-x. 3 greg greg 4096 May 5 12:49 . After: # ls -ld drwxr-xr-x. 3 greg greg 4096 May 5 12:49 . # chown root.root . # ls -ld drwxr-xr-x. 3 root root 4096 May 5 12:50 . and from the host: ls -al .virtfs_metadata_root -rwx------. 1 greg greg 26 May 5 12:50 .virtfs_metadata_root $ cat .virtfs_metadata_root virtfs.uid=3D0 virtfs.gid=3D0 Reported-by: Leo Gaspard Signed-off-by: Greg Kurz Reviewed-by: Eric Blake --- v2: - changed metadata file mode bits to 0600 - fixed typo in commit message - rebased --- hw/9pfs/9p-local.c | 81 +++++++++++++++++++++++++++++++++++-------------= ---- 1 file changed, 54 insertions(+), 27 deletions(-) diff --git a/hw/9pfs/9p-local.c b/hw/9pfs/9p-local.c index b30f68f91026..8babd5542f06 100644 --- a/hw/9pfs/9p-local.c +++ b/hw/9pfs/9p-local.c @@ -107,6 +107,7 @@ static void unlinkat_preserve_errno(int dirfd, const ch= ar *path, int flags) } =20 #define VIRTFS_META_DIR ".virtfs_metadata" +#define VIRTFS_META_ROOT_FILE VIRTFS_META_DIR "_root" =20 static FILE *local_fopenat(int dirfd, const char *name, const char *mode) { @@ -143,13 +144,17 @@ static void local_mapped_file_attr(int dirfd, const c= har *name, char buf[ATTR_MAX]; int map_dirfd; =20 - map_dirfd =3D openat_dir(dirfd, VIRTFS_META_DIR); - if (map_dirfd =3D=3D -1) { - return; - } + if (strcmp(name, ".")) { + map_dirfd =3D openat_dir(dirfd, VIRTFS_META_DIR); + if (map_dirfd =3D=3D -1) { + return; + } =20 - fp =3D local_fopenat(map_dirfd, name, "r"); - close_preserve_errno(map_dirfd); + fp =3D local_fopenat(map_dirfd, name, "r"); + close_preserve_errno(map_dirfd); + } else { + fp =3D local_fopenat(dirfd, VIRTFS_META_ROOT_FILE, "r"); + } if (!fp) { return; } @@ -227,26 +232,38 @@ static int local_set_mapped_file_attrat(int dirfd, co= nst char *name, int ret; char buf[ATTR_MAX]; int uid =3D -1, gid =3D -1, mode =3D -1, rdev =3D -1; - int map_dirfd; - - ret =3D mkdirat(dirfd, VIRTFS_META_DIR, 0700); - if (ret < 0 && errno !=3D EEXIST) { - return -1; - } - - map_dirfd =3D openat_dir(dirfd, VIRTFS_META_DIR); - if (map_dirfd =3D=3D -1) { - return -1; - } + int map_dirfd, map_fd; + bool is_root =3D !strcmp(name, "."); + + if (is_root) { + fp =3D local_fopenat(dirfd, VIRTFS_META_ROOT_FILE, "r"); + if (!fp) { + if (errno =3D=3D ENOENT) { + goto update_map_file; + } else { + return -1; + } + } + } else { + ret =3D mkdirat(dirfd, VIRTFS_META_DIR, 0700); + if (ret < 0 && errno !=3D EEXIST) { + return -1; + } =20 - fp =3D local_fopenat(map_dirfd, name, "r"); - if (!fp) { - if (errno =3D=3D ENOENT) { - goto update_map_file; - } else { - close_preserve_errno(map_dirfd); + map_dirfd =3D openat_dir(dirfd, VIRTFS_META_DIR); + if (map_dirfd =3D=3D -1) { return -1; } + + fp =3D local_fopenat(map_dirfd, name, "r"); + if (!fp) { + if (errno =3D=3D ENOENT) { + goto update_map_file; + } else { + close_preserve_errno(map_dirfd); + return -1; + } + } } memset(buf, 0, ATTR_MAX); while (fgets(buf, ATTR_MAX, fp)) { @@ -264,12 +281,21 @@ static int local_set_mapped_file_attrat(int dirfd, co= nst char *name, fclose(fp); =20 update_map_file: - fp =3D local_fopenat(map_dirfd, name, "w"); - close_preserve_errno(map_dirfd); + if (is_root) { + fp =3D local_fopenat(dirfd, VIRTFS_META_ROOT_FILE, "w"); + } else { + fp =3D local_fopenat(map_dirfd, name, "w"); + close_preserve_errno(map_dirfd); + } if (!fp) { return -1; } =20 + map_fd =3D fileno(fp); + assert(map_fd !=3D -1); + ret =3D fchmod(map_fd, 0600); + assert(ret =3D=3D 0); + if (credp->fc_uid !=3D -1) { uid =3D credp->fc_uid; } @@ -478,7 +504,8 @@ static off_t local_telldir(FsContext *ctx, V9fsFidOpenS= tate *fs) =20 static bool local_is_mapped_file_metadata(FsContext *fs_ctx, const char *n= ame) { - return !strcmp(name, VIRTFS_META_DIR); + return + !strcmp(name, VIRTFS_META_DIR) || !strcmp(name, VIRTFS_META_ROOT_F= ILE); } =20 static struct dirent *local_readdir(FsContext *ctx, V9fsFidOpenState *fs) @@ -495,7 +522,7 @@ again: entry->d_type =3D DT_UNKNOWN; } else if (ctx->export_flags & V9FS_SM_MAPPED_FILE) { if (local_is_mapped_file_metadata(ctx, entry->d_name)) { - /* skip the meta data directory */ + /* skip the meta data */ goto again; } entry->d_type =3D DT_UNKNOWN;