From 74e1ebee7f037feea6e393179ac261036b9e2476 Mon Sep 17 00:00:00 2001 From: Peng Liang Date: Mon, 18 Oct 2021 17:20:11 +0800 Subject: [PATCH] qemu: Move pid file of pr-helper to stateDir Libvirt will put the pid file of pr-helper to per-domain directory. However, the ownership of the per-domain directory is the user to run the QEMU process and the user has the write permission of the directory. If VM escape occurs, the attacker can 1. write arbitrary content to the pid file (if running QEMU using root), then the attacker can kill any process by writing appropriate pid to the pid file; 2. spoof the pid file (if running QEMU using a regular user), then the pr-helper process will never be cleared even if the VM is destroyed. So, move the pid file of pr-helper from per-domain directory to stateDir. Signed-off-by: Peng Liang Reviewed-by: Michal Privoznik --- src/qemu/qemu_process.c | 22 +++++++++++++++++++++- 1 file changed, 21 insertions(+), 1 deletion(-) diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c index f95ed80fac..6027b30405 100644 --- a/src/qemu/qemu_process.c +++ b/src/qemu/qemu_process.c @@ -2856,7 +2856,7 @@ qemuProcessResctrlCreate(virQEMUDriver *driver, static char * -qemuProcessBuildPRHelperPidfilePath(virDomainObj *vm) +qemuProcessBuildPRHelperPidfilePathOld(virDomainObj *vm) { qemuDomainObjPrivate *priv = vm->privateData; const char *prdAlias = qemuDomainGetManagedPRAlias(); @@ -2865,6 +2865,18 @@ qemuProcessBuildPRHelperPidfilePath(virDomainObj *vm) } +static char * +qemuProcessBuildPRHelperPidfilePath(virDomainObj *vm) +{ + qemuDomainObjPrivate *priv = vm->privateData; + g_autofree char *domname = virDomainDefGetShortName(vm->def); + g_autofree char *prdName = g_strdup_printf("%s-%s", domname, qemuDomainGetManagedPRAlias()); + g_autoptr(virQEMUDriverConfig) cfg = virQEMUDriverGetConfig(priv->driver); + + return virPidFileBuildPath(cfg->stateDir, prdName); +} + + void qemuProcessKillManagedPRDaemon(virDomainObj *vm) { @@ -2877,6 +2889,14 @@ qemuProcessKillManagedPRDaemon(virDomainObj *vm) return; } + if (!virFileExists(pidfile)) { + g_free(pidfile); + if (!(pidfile = qemuProcessBuildPRHelperPidfilePathOld(vm))) { + VIR_WARN("Unable to construct pr-helper pidfile path"); + return; + } + } + virErrorPreserveLast(&orig_err); if (virPidFileForceCleanupPath(pidfile) < 0) { VIR_WARN("Unable to kill pr-helper process");