mir/lxc
2
0
Fork 0
mirror of git://github.com/lxc/lxc synced 2025-09-01 00:58:00 +00:00
Code Issues Releases Wiki Activity

CVE-2015-1331: lxclock: use /run/lxc/lock rather than /run/lock/lxc

Browse Source 
This prevents an unprivileged user to use LXC to create arbitrary file
on the filesystem.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
This commit is contained in:
Serge Hallyn
2015-07-03 09:26:17 -05:00
committed by Stéphane Graber
parent f52c0d2677
commit 72cf81f6a3
2 changed files with 11 additions and 38 deletions
Download Patch File Download Diff File Expand all files Collapse all files

47
src/lxc/lxclock.c
View File

@@ -103,13 +103,13 @@ static char *lxclock_name(const char *p, const char *n)
char *rundir;
/* lockfile will be:
* "/run" + "/lock/lxc/$lxcpath/$lxcname + '\0' if root
* "/run" + "/lxc/lock/$lxcpath/$lxcname + '\0' if root
* or
* $XDG_RUNTIME_DIR + "/lock/lxc/$lxcpath/$lxcname + '\0' if non-root
* $XDG_RUNTIME_DIR + "/lxc/lock/$lxcpath/$lxcname + '\0' if non-root
*/
/* length of "/lock/lxc/" + $lxcpath + "/" + "." + $lxcname + '\0' */
len = strlen("/lock/lxc/") + strlen(n) + strlen(p) + 3;
/* length of "/lxc/lock/" + $lxcpath + "/" + "." + $lxcname + '\0' */
len = strlen("/lxc/lock/") + strlen(n) + strlen(p) + 3;
rundir = get_rundir();
if (!rundir)
return NULL;
@@ -120,7 +120,7 @@ static char *lxclock_name(const char *p, const char *n)
return NULL;
}
ret = snprintf(dest, len, "%s/lock/lxc/%s", rundir, p);
ret = snprintf(dest, len, "%s/lxc/lock/%s", rundir, p);
if (ret < 0 || ret >= len) {
free(dest);
free(rundir);
@@ -128,40 +128,13 @@ static char *lxclock_name(const char *p, const char *n)
}
ret = mkdir_p(dest, 0755);
if (ret < 0) {
/* fall back to "/tmp/" + $(id -u) + "/lxc" + $lxcpath + "/" + "." + $lxcname + '\0'
* * maximum length of $(id -u) is 10 calculated by (log (2 ** (sizeof(uid_t) * 8) - 1) / log 10 + 1)
* * lxcpath always starts with '/'
*/
int l2 = 22 + strlen(n) + strlen(p);
if (l2 > len) {
char *d;
d = realloc(dest, l2);
if (!d) {
free(dest);
free(rundir);
return NULL;
}
len = l2;
dest = d;
}
ret = snprintf(dest, len, "/tmp/%d/lxc%s", geteuid(), p);
if (ret < 0 || ret >= len) {
free(dest);
free(rundir);
return NULL;
}
ret = mkdir_p(dest, 0755);
if (ret < 0) {
free(dest);
free(rundir);
return NULL;
}
ret = snprintf(dest, len, "/tmp/%d/lxc%s/.%s", geteuid(), p, n);
} else
ret = snprintf(dest, len, "%s/lock/lxc/%s/.%s", rundir, p, n);
free(dest);
free(rundir);
return NULL;
}
ret = snprintf(dest, len, "%s/lxc/lock/%s/.%s", rundir, p, n);
free(rundir);
if (ret < 0 || ret >= len) {
free(dest);
return NULL;

2
src/tests/locktests.c
View File

@@ -122,7 +122,7 @@ int main(int argc, char *argv[])
exit(1);
}
struct stat sb;
char *pathname = RUNTIME_PATH "/lock/lxc/var/lib/lxc/";
char *pathname = RUNTIME_PATH "/lxc/lock/var/lib/lxc/";
ret = stat(pathname, &sb);
if (ret != 0) {
fprintf(stderr, "%d: filename %s not created\n", __LINE__,