From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([208.118.235.92]:51554) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1UeTyy-0002st-5Z for qemu-devel@nongnu.org; Mon, 20 May 2013 13:34:49 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1UeTyx-0006MJ-7T for qemu-devel@nongnu.org; Mon, 20 May 2013 13:34:48 -0400 Received: from e23smtp04.au.ibm.com ([202.81.31.146]:57200) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1UeTyw-0006M3-KH for qemu-devel@nongnu.org; Mon, 20 May 2013 13:34:47 -0400 Received: from /spool/local by e23smtp04.au.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Tue, 21 May 2013 03:21:41 +1000 Received: from d23relay04.au.ibm.com (d23relay04.au.ibm.com [9.190.234.120]) by d23dlp02.au.ibm.com (Postfix) with ESMTP id BDB6C2BB0050 for ; Tue, 21 May 2013 03:34:36 +1000 (EST) Received: from d23av04.au.ibm.com (d23av04.au.ibm.com [9.190.235.139]) by d23relay04.au.ibm.com (8.13.8/8.13.8/NCO v10.0) with ESMTP id r4KHKTpE23593038 for ; Tue, 21 May 2013 03:20:30 +1000 Received: from d23av04.au.ibm.com (loopback [127.0.0.1]) by d23av04.au.ibm.com (8.14.4/8.13.1/NCO v10.0 AVout) with ESMTP id r4KHYZVh002397 for ; Tue, 21 May 2013 03:34:35 +1000 From: "Aneesh Kumar K.V" Date: Mon, 20 May 2013 23:04:29 +0530 Message-Id: <1369071269-25903-1-git-send-email-aneesh.kumar@linux.vnet.ibm.com> Subject: [Qemu-devel] [PATCH] hw/9pfs: use O_NOFOLLOW for mapped readlink operation List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: aliguori@us.ibm.com, "Aneesh Kumar K.V" From: "Aneesh Kumar K.V" With mapped security models like mapped-xattr and mapped-file, we save the symlink target as file contents. Now if we ever expose a normal directory with mapped security model and find real symlinks in export path, never follow them and return proper error. Signed-off-by: Aneesh Kumar K.V --- hw/9pfs/virtio-9p-local.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/9pfs/virtio-9p-local.c b/hw/9pfs/virtio-9p-local.c index 6ece6f7..87aa75d 100644 --- a/hw/9pfs/virtio-9p-local.c +++ b/hw/9pfs/virtio-9p-local.c @@ -284,7 +284,7 @@ static ssize_t local_readlink(FsContext *fs_ctx, V9fsPath *fs_path, if ((fs_ctx->export_flags & V9FS_SM_MAPPED) || (fs_ctx->export_flags & V9FS_SM_MAPPED_FILE)) { int fd; - fd = open(rpath(fs_ctx, path, buffer), O_RDONLY); + fd = open(rpath(fs_ctx, path, buffer), O_RDONLY | O_NOFOLLOW); if (fd == -1) { return -1; } -- 1.8.1.2