From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:44849) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bXXhy-0000vu-I2 for qemu-devel@nongnu.org; Wed, 10 Aug 2016 13:54:27 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1bXXhu-0003IE-MI for qemu-devel@nongnu.org; Wed, 10 Aug 2016 13:54:25 -0400 Received: from 20.mo6.mail-out.ovh.net ([178.32.124.17]:59989) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bXXhu-0003Hv-Fq for qemu-devel@nongnu.org; Wed, 10 Aug 2016 13:54:22 -0400 Received: from player756.ha.ovh.net (b7.ovh.net [213.186.33.57]) by mo6.mail-out.ovh.net (Postfix) with ESMTP id 63130FF9327 for ; Wed, 10 Aug 2016 19:54:20 +0200 (CEST) Date: Wed, 10 Aug 2016 19:54:11 +0200 From: Greg Kurz Message-ID: <20160810195411.0c3b3ef8@kaod.org> In-Reply-To: References: <8760rb63lz.fsf@skywalker.in.ibm.com> <20160810114628.3abb437c@kaod.org> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Subject: Re: [Qemu-devel] About a virtio 9p backend issue List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: P J P Cc: "Aneesh Kumar K.V" , Felix Wilhelm , "Michael S. Tsirkin" , qemu-devel@nongnu.org Le Wed, 10 Aug 2016 20:28:27 +0530 (IST), P J P a =C3=A9crit : > +-- On Wed, 10 Aug 2016, Greg Kurz wrote --+ > | As Michael already pointed in a previous mail, this will break legal pa= ths > | with a component ending in ".." like "foo../bar". The fix should only b= an > | paths containing a component that is strictly equal to "..". >=20 > But that would not fix the path traversal issue, would it? As in, one c= ould=20 > traverse the path like foo/bar/../../bar1 ? >=20 Unless I've missed something, if you forbid all paths containing at least o= ne ".." component, the path traversal issue is fixed, isn't it ? Something like strstr(path, "/../") or paths starting with "../" or ending with "/.." ? I don't expect the official linux driver to pass relative paths to QEMU, but I cannot check this out. I guess you should verify that it is still possible to use relative paths in the guest. And what about the other backends, especially the proxy one ? Also I realize this thread is private: please Cc qemu-devel when sending your patch and don't forget to add appropriate Signed-off-by tags, as it is mandatory for acceptance. Thanks for chasing this issue. I think it's been there for a long time but it would be great to have this fixed in 2.7. Cheers. -- Greg > Thank you. > -- > Prasad J Pandit / Red Hat Product Security Team > 47AF CE69 3A90 54AA 9045 1053 DD13 3D32 FE5B 041F