NuKVM/libvirt
3
0
Fork 0
mirror of https://github.com/libvirt/libvirt.git synced 2025-02-25 18:55:26 -06:00
Code Issues Packages Projects Releases Wiki Activity

remote: enforce ACL write permission for getting guest time & hostname

Browse Source 
Getting the guest time and hostname both require use of guest agent
commands. These must not be allowed for read-only users, so the
permissions check must validate "write" permission not "read".

Fixes CVE-2019-3886
Reviewed-by: Jim Fehlig <jfehlig@suse.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
This commit is contained in:
Daniel P. Berrangé 2019-03-27 11:22:49 +00:00
parent 2a07c990bd
commit ae076bb40e
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/remote/remote_protocol.x
View File

@ -5513,7 +5513,7 @@ enum remote_procedure {
/** /**
* @generate: both * @generate: both
* @acl: domain:read * @acl: domain:write
*/ */
REMOTE_PROC_DOMAIN_GET_HOSTNAME = 277, REMOTE_PROC_DOMAIN_GET_HOSTNAME = 277,
@ -5908,7 +5908,7 @@ enum remote_procedure {
/** /**
* @generate: none * @generate: none
* @acl: domain:read * @acl: domain:write
*/ */
REMOTE_PROC_DOMAIN_GET_TIME = 337, REMOTE_PROC_DOMAIN_GET_TIME = 337,