diff mbox series

[053/104] virtiofsd: Drop CAP_FSETID if client asked for it

Message ID 20191212163904.159893-54-dgilbert@redhat.com
State New
Headers show
Series virtiofs daemon [all] | expand

Commit Message

Dr. David Alan Gilbert Dec. 12, 2019, 4:38 p.m. UTC 
From: Vivek Goyal <vgoyal@redhat.com>

If client requested killing setuid/setgid bits on file being written, drop
CAP_FSETID capability so that setuid/setgid bits are cleared upon write
automatically.

pjdfstest chown/12.t needs this.

Signed-off-by: Vivek Goyal <vgoyal@redhat.com>
  dgilbert: reworked for libcap-ng
---
 tools/virtiofsd/passthrough_ll.c | 105 +++++++++++++++++++++++++++++++
 1 file changed, 105 insertions(+)

Comments

Misono Tomohiro Jan. 16, 2020, 4:41 a.m. UTC | #1 
> From: Vivek Goyal <vgoyal@redhat.com>
> 
> If client requested killing setuid/setgid bits on file being written, drop
> CAP_FSETID capability so that setuid/setgid bits are cleared upon write
> automatically.
> 
> pjdfstest chown/12.t needs this.
> 
> Signed-off-by: Vivek Goyal <vgoyal@redhat.com>
>   dgilbert: reworked for libcap-ng

Looks good to me.
 Reviewed-by: Misono Tomohiro <misono.tomohiro@jp.fujitsu.com>

> ---
>  tools/virtiofsd/passthrough_ll.c | 105 +++++++++++++++++++++++++++++++
>  1 file changed, 105 insertions(+)
> 
> diff --git a/tools/virtiofsd/passthrough_ll.c b/tools/virtiofsd/passthrough_ll.c
> index 6a09b28608..ab318a6f36 100644
> --- a/tools/virtiofsd/passthrough_ll.c
> +++ b/tools/virtiofsd/passthrough_ll.c
> @@ -201,6 +201,91 @@ static int load_capng(void)
>      return 0;
>  }
>  
> +/*
> + * Helpers for dropping and regaining effective capabilities. Returns 0
> + * on success, error otherwise
> + */
> +static int drop_effective_cap(const char *cap_name, bool *cap_dropped)
> +{
> +    int cap, ret;
> +
> +    cap = capng_name_to_capability(cap_name);
> +    if (cap < 0) {
> +        ret = errno;
> +        fuse_log(FUSE_LOG_ERR, "capng_name_to_capability(%s) failed:%s\n",
> +                 cap_name, strerror(errno));
> +        goto out;
> +    }
> +
> +    if (load_capng()) {
> +        ret = errno;
> +        fuse_log(FUSE_LOG_ERR, "load_capng() failed\n");
> +        goto out;
> +    }
> +
> +    /* We dont have this capability in effective set already. */
> +    if (!capng_have_capability(CAPNG_EFFECTIVE, cap)) {
> +        ret = 0;
> +        goto out;
> +    }
> +
> +    if (capng_update(CAPNG_DROP, CAPNG_EFFECTIVE, cap)) {
> +        ret = errno;
> +        fuse_log(FUSE_LOG_ERR, "capng_update(DROP,) failed\n");
> +        goto out;
> +    }
> +
> +    if (capng_apply(CAPNG_SELECT_CAPS)) {
> +        ret = errno;
> +        fuse_log(FUSE_LOG_ERR, "drop:capng_apply() failed\n");
> +        goto out;
> +    }
> +
> +    ret = 0;
> +    if (cap_dropped) {
> +        *cap_dropped = true;
> +    }
> +
> +out:
> +    return ret;
> +}
> +
> +static int gain_effective_cap(const char *cap_name)
> +{
> +    int cap;
> +    int ret = 0;
> +
> +    cap = capng_name_to_capability(cap_name);
> +    if (cap < 0) {
> +        ret = errno;
> +        fuse_log(FUSE_LOG_ERR, "capng_name_to_capability(%s) failed:%s\n",
> +                 cap_name, strerror(errno));
> +        goto out;
> +    }
> +
> +    if (load_capng()) {
> +        ret = errno;
> +        fuse_log(FUSE_LOG_ERR, "load_capng() failed\n");
> +        goto out;
> +    }
> +
> +    if (capng_update(CAPNG_ADD, CAPNG_EFFECTIVE, cap)) {
> +        ret = errno;
> +        fuse_log(FUSE_LOG_ERR, "capng_update(ADD,) failed\n");
> +        goto out;
> +    }
> +
> +    if (capng_apply(CAPNG_SELECT_CAPS)) {
> +        ret = errno;
> +        fuse_log(FUSE_LOG_ERR, "gain:capng_apply() failed\n");
> +        goto out;
> +    }
> +    ret = 0;
> +
> +out:
> +    return ret;
> +}
> +
>  static void lo_map_init(struct lo_map *map)
>  {
>      map->elems = NULL;
> @@ -1559,6 +1644,7 @@ static void lo_write_buf(fuse_req_t req, fuse_ino_t ino,
>      (void)ino;
>      ssize_t res;
>      struct fuse_bufvec out_buf = FUSE_BUFVEC_INIT(fuse_buf_size(in_buf));
> +    bool cap_fsetid_dropped = false;
>  
>      out_buf.buf[0].flags = FUSE_BUF_IS_FD | FUSE_BUF_FD_SEEK;
>      out_buf.buf[0].fd = lo_fi_fd(req, fi);
> @@ -1570,12 +1656,31 @@ static void lo_write_buf(fuse_req_t req, fuse_ino_t ino,
>                   out_buf.buf[0].size, (unsigned long)off);
>      }
>  
> +    /*
> +     * If kill_priv is set, drop CAP_FSETID which should lead to kernel
> +     * clearing setuid/setgid on file.
> +     */
> +    if (fi->kill_priv) {
> +        res = drop_effective_cap("FSETID", &cap_fsetid_dropped);
> +        if (res != 0) {
> +            fuse_reply_err(req, res);
> +            return;
> +        }
> +    }
> +
>      res = fuse_buf_copy(&out_buf, in_buf, 0);
>      if (res < 0) {
>          fuse_reply_err(req, -res);
>      } else {
>          fuse_reply_write(req, (size_t)res);
>      }
> +
> +    if (cap_fsetid_dropped) {
> +        res = gain_effective_cap("FSETID");
> +        if (res) {
> +            fuse_log(FUSE_LOG_ERR, "Failed to gain CAP_FSETID\n");
> +        }
> +    }
>  }
>  
>  static void lo_statfs(fuse_req_t req, fuse_ino_t ino)
> -- 
> 2.23.0
Sergio Lopez Jan. 16, 2020, 3:21 p.m. UTC | #2 
Dr. David Alan Gilbert (git) <dgilbert@redhat.com> writes:

> From: Vivek Goyal <vgoyal@redhat.com>
>
> If client requested killing setuid/setgid bits on file being written, drop
> CAP_FSETID capability so that setuid/setgid bits are cleared upon write
> automatically.
>
> pjdfstest chown/12.t needs this.
>
> Signed-off-by: Vivek Goyal <vgoyal@redhat.com>
>   dgilbert: reworked for libcap-ng
> ---
>  tools/virtiofsd/passthrough_ll.c | 105 +++++++++++++++++++++++++++++++
>  1 file changed, 105 insertions(+)
>
> diff --git a/tools/virtiofsd/passthrough_ll.c b/tools/virtiofsd/passthrough_ll.c
> index 6a09b28608..ab318a6f36 100644
> --- a/tools/virtiofsd/passthrough_ll.c
> +++ b/tools/virtiofsd/passthrough_ll.c
> @@ -201,6 +201,91 @@ static int load_capng(void)
>      return 0;
>  }
>
> +/*
> + * Helpers for dropping and regaining effective capabilities. Returns 0
> + * on success, error otherwise
> + */
> +static int drop_effective_cap(const char *cap_name, bool *cap_dropped)
> +{
> +    int cap, ret;
> +
> +    cap = capng_name_to_capability(cap_name);
> +    if (cap < 0) {
> +        ret = errno;
> +        fuse_log(FUSE_LOG_ERR, "capng_name_to_capability(%s) failed:%s\n",
> +                 cap_name, strerror(errno));
> +        goto out;
> +    }
> +
> +    if (load_capng()) {
> +        ret = errno;
> +        fuse_log(FUSE_LOG_ERR, "load_capng() failed\n");
> +        goto out;
> +    }
> +
> +    /* We dont have this capability in effective set already. */
> +    if (!capng_have_capability(CAPNG_EFFECTIVE, cap)) {
> +        ret = 0;
> +        goto out;
> +    }
> +
> +    if (capng_update(CAPNG_DROP, CAPNG_EFFECTIVE, cap)) {
> +        ret = errno;
> +        fuse_log(FUSE_LOG_ERR, "capng_update(DROP,) failed\n");
> +        goto out;
> +    }
> +
> +    if (capng_apply(CAPNG_SELECT_CAPS)) {
> +        ret = errno;
> +        fuse_log(FUSE_LOG_ERR, "drop:capng_apply() failed\n");
> +        goto out;
> +    }
> +
> +    ret = 0;
> +    if (cap_dropped) {
> +        *cap_dropped = true;
> +    }
> +
> +out:
> +    return ret;
> +}
> +
> +static int gain_effective_cap(const char *cap_name)
> +{
> +    int cap;
> +    int ret = 0;
> +
> +    cap = capng_name_to_capability(cap_name);
> +    if (cap < 0) {
> +        ret = errno;
> +        fuse_log(FUSE_LOG_ERR, "capng_name_to_capability(%s) failed:%s\n",
> +                 cap_name, strerror(errno));
> +        goto out;
> +    }
> +
> +    if (load_capng()) {
> +        ret = errno;
> +        fuse_log(FUSE_LOG_ERR, "load_capng() failed\n");
> +        goto out;
> +    }
> +
> +    if (capng_update(CAPNG_ADD, CAPNG_EFFECTIVE, cap)) {
> +        ret = errno;
> +        fuse_log(FUSE_LOG_ERR, "capng_update(ADD,) failed\n");
> +        goto out;
> +    }
> +
> +    if (capng_apply(CAPNG_SELECT_CAPS)) {
> +        ret = errno;
> +        fuse_log(FUSE_LOG_ERR, "gain:capng_apply() failed\n");
> +        goto out;
> +    }
> +    ret = 0;
> +
> +out:
> +    return ret;
> +}
> +
>  static void lo_map_init(struct lo_map *map)
>  {
>      map->elems = NULL;
> @@ -1559,6 +1644,7 @@ static void lo_write_buf(fuse_req_t req, fuse_ino_t ino,
>      (void)ino;
>      ssize_t res;
>      struct fuse_bufvec out_buf = FUSE_BUFVEC_INIT(fuse_buf_size(in_buf));
> +    bool cap_fsetid_dropped = false;
>
>      out_buf.buf[0].flags = FUSE_BUF_IS_FD | FUSE_BUF_FD_SEEK;
>      out_buf.buf[0].fd = lo_fi_fd(req, fi);
> @@ -1570,12 +1656,31 @@ static void lo_write_buf(fuse_req_t req, fuse_ino_t ino,
>                   out_buf.buf[0].size, (unsigned long)off);
>      }
>
> +    /*
> +     * If kill_priv is set, drop CAP_FSETID which should lead to kernel
> +     * clearing setuid/setgid on file.
> +     */
> +    if (fi->kill_priv) {
> +        res = drop_effective_cap("FSETID", &cap_fsetid_dropped);
> +        if (res != 0) {
> +            fuse_reply_err(req, res);
> +            return;
> +        }
> +    }
> +
>      res = fuse_buf_copy(&out_buf, in_buf, 0);
>      if (res < 0) {
>          fuse_reply_err(req, -res);
>      } else {
>          fuse_reply_write(req, (size_t)res);
>      }
> +
> +    if (cap_fsetid_dropped) {
> +        res = gain_effective_cap("FSETID");
> +        if (res) {
> +            fuse_log(FUSE_LOG_ERR, "Failed to gain CAP_FSETID\n");
> +        }
> +    }
>  }
>
>  static void lo_statfs(fuse_req_t req, fuse_ino_t ino)

Fiddling with the capabilities for clearing setuid/setgid on a file
seems a bit weird to me, but I see this was already discussed in
https://lkml.org/lkml/2019/5/20/1229, so...

Reviewed-by: Sergio Lopez <slp@redhat.com>
diff mbox series

Patch

diff --git a/tools/virtiofsd/passthrough_ll.c b/tools/virtiofsd/passthrough_ll.c
index 6a09b28608..ab318a6f36 100644
--- a/tools/virtiofsd/passthrough_ll.c
+++ b/tools/virtiofsd/passthrough_ll.c
@@ -201,6 +201,91 @@  static int load_capng(void)
     return 0;
 }
 
+/*
+ * Helpers for dropping and regaining effective capabilities. Returns 0
+ * on success, error otherwise
+ */
+static int drop_effective_cap(const char *cap_name, bool *cap_dropped)
+{
+    int cap, ret;
+
+    cap = capng_name_to_capability(cap_name);
+    if (cap < 0) {
+        ret = errno;
+        fuse_log(FUSE_LOG_ERR, "capng_name_to_capability(%s) failed:%s\n",
+                 cap_name, strerror(errno));
+        goto out;
+    }
+
+    if (load_capng()) {
+        ret = errno;
+        fuse_log(FUSE_LOG_ERR, "load_capng() failed\n");
+        goto out;
+    }
+
+    /* We dont have this capability in effective set already. */
+    if (!capng_have_capability(CAPNG_EFFECTIVE, cap)) {
+        ret = 0;
+        goto out;
+    }
+
+    if (capng_update(CAPNG_DROP, CAPNG_EFFECTIVE, cap)) {
+        ret = errno;
+        fuse_log(FUSE_LOG_ERR, "capng_update(DROP,) failed\n");
+        goto out;
+    }
+
+    if (capng_apply(CAPNG_SELECT_CAPS)) {
+        ret = errno;
+        fuse_log(FUSE_LOG_ERR, "drop:capng_apply() failed\n");
+        goto out;
+    }
+
+    ret = 0;
+    if (cap_dropped) {
+        *cap_dropped = true;
+    }
+
+out:
+    return ret;
+}
+
+static int gain_effective_cap(const char *cap_name)
+{
+    int cap;
+    int ret = 0;
+
+    cap = capng_name_to_capability(cap_name);
+    if (cap < 0) {
+        ret = errno;
+        fuse_log(FUSE_LOG_ERR, "capng_name_to_capability(%s) failed:%s\n",
+                 cap_name, strerror(errno));
+        goto out;
+    }
+
+    if (load_capng()) {
+        ret = errno;
+        fuse_log(FUSE_LOG_ERR, "load_capng() failed\n");
+        goto out;
+    }
+
+    if (capng_update(CAPNG_ADD, CAPNG_EFFECTIVE, cap)) {
+        ret = errno;
+        fuse_log(FUSE_LOG_ERR, "capng_update(ADD,) failed\n");
+        goto out;
+    }
+
+    if (capng_apply(CAPNG_SELECT_CAPS)) {
+        ret = errno;
+        fuse_log(FUSE_LOG_ERR, "gain:capng_apply() failed\n");
+        goto out;
+    }
+    ret = 0;
+
+out:
+    return ret;
+}
+
 static void lo_map_init(struct lo_map *map)
 {
     map->elems = NULL;
@@ -1559,6 +1644,7 @@  static void lo_write_buf(fuse_req_t req, fuse_ino_t ino,
     (void)ino;
     ssize_t res;
     struct fuse_bufvec out_buf = FUSE_BUFVEC_INIT(fuse_buf_size(in_buf));
+    bool cap_fsetid_dropped = false;
 
     out_buf.buf[0].flags = FUSE_BUF_IS_FD | FUSE_BUF_FD_SEEK;
     out_buf.buf[0].fd = lo_fi_fd(req, fi);
@@ -1570,12 +1656,31 @@  static void lo_write_buf(fuse_req_t req, fuse_ino_t ino,
                  out_buf.buf[0].size, (unsigned long)off);
     }
 
+    /*
+     * If kill_priv is set, drop CAP_FSETID which should lead to kernel
+     * clearing setuid/setgid on file.
+     */
+    if (fi->kill_priv) {
+        res = drop_effective_cap("FSETID", &cap_fsetid_dropped);
+        if (res != 0) {
+            fuse_reply_err(req, res);
+            return;
+        }
+    }
+
     res = fuse_buf_copy(&out_buf, in_buf, 0);
     if (res < 0) {
         fuse_reply_err(req, -res);
     } else {
         fuse_reply_write(req, (size_t)res);
     }
+
+    if (cap_fsetid_dropped) {
+        res = gain_effective_cap("FSETID");
+        if (res) {
+            fuse_log(FUSE_LOG_ERR, "Failed to gain CAP_FSETID\n");
+        }
+    }
 }
 
 static void lo_statfs(fuse_req_t req, fuse_ino_t ino)