From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from [140.186.70.92] (port=47802 helo=eggs.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1PpgPm-0005El-0K for qemu-devel@nongnu.org; Wed, 16 Feb 2011 07:23:26 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1PpgPk-00029K-LK for qemu-devel@nongnu.org; Wed, 16 Feb 2011 07:23:25 -0500 Received: from e28smtp01.in.ibm.com ([122.248.162.1]:38507) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1PpgPj-000258-UF for qemu-devel@nongnu.org; Wed, 16 Feb 2011 07:23:24 -0500 Received: from d28relay03.in.ibm.com (d28relay03.in.ibm.com [9.184.220.60]) by e28smtp01.in.ibm.com (8.14.4/8.13.1) with ESMTP id p1GCNIdt001347 for ; Wed, 16 Feb 2011 17:53:18 +0530 Received: from d28av02.in.ibm.com (d28av02.in.ibm.com [9.184.220.64]) by d28relay03.in.ibm.com (8.13.8/8.13.8/NCO v10.0) with ESMTP id p1GCNGpX4206612 for ; Wed, 16 Feb 2011 17:53:17 +0530 Received: from d28av02.in.ibm.com (loopback [127.0.0.1]) by d28av02.in.ibm.com (8.14.4/8.13.1/NCO v10.0 AVout) with ESMTP id p1GCNGxm009573 for ; Wed, 16 Feb 2011 23:23:16 +1100 From: "M. Mohan Kumar" Date: Wed, 16 Feb 2011 17:53:07 +0530 Message-Id: <1297858995-24676-1-git-send-email-mohan@in.ibm.com> Subject: [Qemu-devel] [V5 PATCH 0/8] virtio-9p: Use chroot to safely access files in passthrough security model List-Id: qemu-devel.nongnu.org List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org, Stefan Hajnoczi , "Daniel P. Berrange" , blauwirbel@gmail.com In passthrough security model, following symbolic links in the server side could result in TOCTTOU vulnerabilities. This patchset resolves this issue by creating a dedicated process which chroots into the share path and all file object access is done in the chroot environment. This patchset implements chroot enviroment, provides necessary functions that can be used by the passthrough function calls. Changes from version V4: * Avoid using malloc/free inside chroot process * Seperate chroot server and client functions Changes from version V3 * Return EIO incase of socket read/write fail instead of exiting * Changed data types as suggested by Blue Swirl * Chroot process reports error through qemu process Changes from version V2 * Treat socket IO errors as fatal, ie qemu will exit * Split patchset based on chroot side (server) and qemu side(client) functionalities M. Mohan Kumar (8): Implement qemu_read_full virtio-9p: Provide chroot environment server side interfaces virtio-9p: Add client side interfaces for chroot environment virtio-9p: Add support to open a file in chroot environment virtio-9p: Create support in chroot environment virtio-9p: Support for creating special files virtio-9p: Move file post creation changes to none security model virtio-9p: Chroot environment for other functions Makefile.objs | 1 + hw/9pfs/virtio-9p-chroot-clnt.c | 136 +++++++++++++ hw/9pfs/virtio-9p-chroot-sv.c | 295 +++++++++++++++++++++++++++ hw/9pfs/virtio-9p-chroot.h | 60 ++++++ hw/9pfs/virtio-9p-local.c | 419 +++++++++++++++++++++++++++++++-------- hw/9pfs/virtio-9p.c | 32 +++ hw/file-op-9p.h | 4 + osdep.c | 32 +++ qemu-common.h | 2 + 9 files changed, 901 insertions(+), 80 deletions(-) create mode 100644 hw/9pfs/virtio-9p-chroot-clnt.c create mode 100644 hw/9pfs/virtio-9p-chroot-sv.c create mode 100644 hw/9pfs/virtio-9p-chroot.h -- 1.7.3.4