From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([140.186.70.92]:55905) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1QlGMH-0000Ig-Dt for qemu-devel@nongnu.org; Mon, 25 Jul 2011 04:17:50 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1QlGMG-0005Ld-2v for qemu-devel@nongnu.org; Mon, 25 Jul 2011 04:17:49 -0400 Received: from mail-ew0-f45.google.com ([209.85.215.45]:59423) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1QlGMF-0005LR-RE for qemu-devel@nongnu.org; Mon, 25 Jul 2011 04:17:48 -0400 Received: by ewy24 with SMTP id 24so2674957ewy.4 for ; Mon, 25 Jul 2011 01:17:47 -0700 (PDT) Date: Mon, 25 Jul 2011 09:17:37 +0100 From: Stefan Hajnoczi Message-ID: <20110725081200.GA5266@stefanha-thinkpad.localdomain> References: <1308903744-2870-1-git-send-email-mohan@in.ibm.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1308903744-2870-1-git-send-email-mohan@in.ibm.com> Subject: Re: [Qemu-devel] [V11 00/15] virtio-9p: Use chroot to safely access files in passthrough security model List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: "M. Mohan Kumar" Cc: qemu-devel@nongnu.org On Fri, Jun 24, 2011 at 01:52:09PM +0530, M. Mohan Kumar wrote: > In passthrough security model, following symbolic links in the server > side could result in TOCTTOU vulnerabilities. > (http://en.wikipedia.org/wiki/Time-of-check-to-time-of-use) > > This patchset resolves this issue by creating a dedicated process which > chroots into the share path and all file object access is done in the > chroot environment. > > This patchset implements chroot enviroment, provides necessary functions > that can be used by the passthrough function calls. > > This patchset is rebased on top of 9p coroutines patches posted to > qemu-devel list > http://lists.nongnu.org/archive/html/qemu-devel/2011-05/msg02796.html > > Changes from version V10: > * Added support to do lstat and readlink from chroot process > * Fixed an issue with dealing fds when qemu process reached maxfds limit > > Changes from version V9: > * Error handling in special file object creation in virtio-9p-local.c > > Changes from version V8: > * Make chmod and chown also operate under chroot process > * Check for invalid path requests, minor cleanups > > Changes from version V7: > * Add two chroot methods remove and rename > * Minor cleanups like consolidating functions > > Changes from version V6: > * Send only fd/errno in socket operations instead of FdInfo structure > * Minor cleanups > > Changes from version V5: > * Return errno on failure instead of setting errno > * Minor cleanups like updated comments, enable CONFIG_THREAD if > CONFIG_VIRTFS is enabled > > Changes from version V4: > * Avoid using malloc/free inside chroot process > * Seperate chroot server and client functions > > Changes from version V3 > * Return EIO incase of socket read/write fail instead of exiting > * Changed data types as suggested by Blue Swirl > * Chroot process reports error through qemu process > > Changes from version V2 > * Treat socket IO errors as fatal, ie qemu will exit > * Split patchset based on chroot side (server) and qemu side(client) > functionalities > > M. Mohan Kumar (15): > Implement qemu_read_full > virtio-9p: Enable CONFIG_THREAD if CONFIG_VIRTFS is enabled > virtio-9p: Provide chroot worker side interfaces > virtio-9p: Add qemu side interfaces for chroot environment > virtio-9p: Add support to open a file in chroot environment > virtio-9p: Create support in chroot environment > virtio-9p: Support for creating special files > virtio-9p: Add support for removing file or directory > virtio-9p: Add support to rename > virtio-9p: Move file post creation changes to none security model > virtio-9p: Add support for chmod > virtio-9p: Add support for chown > virtio-9p: Chroot environment for other functions > virtio-9p: Add stat functionality to chroot > virtio-9p: Add readlink support to chroot > > Makefile.objs | 1 + > configure | 1 + > fsdev/file-op-9p.h | 3 + > hw/9pfs/virtio-9p-chroot-worker.c | 418 +++++++++++++++++++++++++++++++++++++ > hw/9pfs/virtio-9p-chroot.c | 174 +++++++++++++++ > hw/9pfs/virtio-9p-chroot.h | 54 +++++ > hw/9pfs/virtio-9p-device.c | 24 ++ > hw/9pfs/virtio-9p-local.c | 248 ++++++++++++++++++---- > osdep.c | 32 +++ > qemu-common.h | 2 + > 10 files changed, 910 insertions(+), 47 deletions(-) > create mode 100644 hw/9pfs/virtio-9p-chroot-worker.c > create mode 100644 hw/9pfs/virtio-9p-chroot.c > create mode 100644 hw/9pfs/virtio-9p-chroot.h > > -- > 1.7.5.1 Reviewed-by: Stefan Hajnoczi