diff options
| author | Daniel P. Berrange <berrange@redhat.com> | 2013-10-03 16:37:57 +0100 |
|---|---|---|
| committer | Daniel P. Berrange <berrange@redhat.com> | 2013-10-21 13:58:40 +0100 |
| commit | 57687fd6bf7f6e1b3662c52f3f26c06ab19dc96c (patch) | |
| tree | c774f5f615c363c6b61d314d2009c9d03c9d88cc | |
| parent | 8d35f9dbad66984564cfd2b84f91568253da6a7a (diff) | |
| download | libvirt-CVE-2013-4401.tar.gz | |
Fix perms for virConnectDomainXML{To,From}Native (CVE-2013-4401)CVE-2013-4401
The virConnectDomainXMLToNative API should require 'connect:write'
not 'connect:read', since it will trigger execution of the QEMU
binaries listed in the XML.
Also make virConnectDomainXMLFromNative API require a full
read-write connection and 'connect:write' permission. Although the
current impl doesn't trigger execution of QEMU, we should not
rely on that impl detail from an API permissioning POV.
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
| -rw-r--r-- | src/libvirt.c | 4 | ||||
| -rw-r--r-- | src/remote/remote_protocol.x | 4 |
2 files changed, 6 insertions, 2 deletions
diff --git a/src/libvirt.c b/src/libvirt.c index 9f579a604d..7fa675ac96 100644 --- a/src/libvirt.c +++ b/src/libvirt.c @@ -4611,6 +4611,10 @@ char *virConnectDomainXMLFromNative(virConnectPtr conn, virDispatchError(NULL); return NULL; } + if (conn->flags & VIR_CONNECT_RO) { + virLibDomainError(VIR_ERR_OPERATION_DENIED, __FUNCTION__); + goto error; + } virCheckNonNullArgGoto(nativeFormat, error); virCheckNonNullArgGoto(nativeConfig, error); diff --git a/src/remote/remote_protocol.x b/src/remote/remote_protocol.x index 810eeca515..f9426704ba 100644 --- a/src/remote/remote_protocol.x +++ b/src/remote/remote_protocol.x @@ -3826,13 +3826,13 @@ enum remote_procedure { /** * @generate: both - * @acl: connect:read + * @acl: connect:write */ REMOTE_PROC_CONNECT_DOMAIN_XML_FROM_NATIVE = 135, /** * @generate: both - * @acl: connect:read + * @acl: connect:write */ REMOTE_PROC_CONNECT_DOMAIN_XML_TO_NATIVE = 136, |