[PATCH 1/1] fsidd: require root credentials on abstract socket

[Olga Kornievskaia <okorniev@redhat.com>]

fsidd listens on an abstract UNIX domain socket which has no
filesystem-level access control.  Any local unprivileged user can
connect and issue mutating commands (get_or_create_fsidnum) that
grow the reexport database without limit, degrading mountd
performance.

Add a SO_PEERCRED check to reject connections from non-root
clients.  The only legitimate client is mountd, which runs as root.

Fixes: 6fd2732d ("export: Add fsidd")
Signed-off-by: Olga Kornievskaia <okorniev@redhat.com>
---
 support/reexport/fsidd.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/support/reexport/fsidd.c b/support/reexport/fsidd.c
index 9b80b451..c714386e 100644
--- a/support/reexport/fsidd.c
+++ b/support/reexport/fsidd.c
@@ -7,6 +7,7 @@
 #include <dlfcn.h>
 #endif
 #include <event2/event.h>
+#include <sys/socket.h>
 #include <sys/un.h>
 #include <unistd.h>
 
@@ -147,6 +148,8 @@ static void srv_cb(evutil_socket_t fd, short ev, void *d)
 {
 	int cl = accept4(fd, NULL, NULL, SOCK_NONBLOCK);
 	struct event *client_ev;
+	struct ucred cred;
+	socklen_t clen = sizeof(cred);
 
 	if (cl == -1) {
 		if (errno == EMFILE || errno == ENFILE || errno == ENOMEM ||
@@ -162,6 +165,12 @@ static void srv_cb(evutil_socket_t fd, short ev, void *d)
 	(void)ev;
 	(void)d;
 
+	if (getsockopt(cl, SOL_SOCKET, SO_PEERCRED, &cred, &clen) < 0 ||
+	    cred.uid != 0) {
+		close(cl);
+		return;
+	}
+
 	client_ev = event_new(evbase, cl, EV_READ | EV_PERSIST | EV_CLOSED, client_cb, event_self_cbarg());
 	if (!client_ev || event_add(client_ev, NULL) == -1) {
 		if (client_ev)
-- 
2.52.0