summaryrefslogtreecommitdiff
path: root/src/journal
diff options
context:
space:
mode:
authorLennart Poettering <lennart@poettering.net>2015-11-10 20:08:04 +0100
committerLennart Poettering <lennart@poettering.net>2015-11-10 21:03:49 +0100
commit1e603a482f57edb1fb863dbf23b868cf5854e004 (patch)
tree2362e3e6f5a9f83e6bff3a7b5d2d21cd65da9179 /src/journal
parente3c4a681db0b7004904b95d55fd1a443161c9397 (diff)
journald: never accept fds from file systems with mandatory locking enabled
This is pretty much a work-around for a security vulnerability in kernels that allow unprivileged user namespaces. Fixes #1822.
Diffstat (limited to 'src/journal')
-rw-r--r--src/journal/journald-native.c30
1 files changed, 30 insertions, 0 deletions
diff --git a/src/journal/journald-native.c b/src/journal/journald-native.c
index 1e3774dafb..69a685c06f 100644
--- a/src/journal/journald-native.c
+++ b/src/journal/journald-native.c
@@ -22,6 +22,7 @@
#include <stddef.h>
#include <sys/epoll.h>
#include <sys/mman.h>
+#include <sys/statvfs.h>
#include <unistd.h>
#include "alloc-util.h"
@@ -399,8 +400,37 @@ void server_process_native_file(
assert_se(munmap(p, ps) >= 0);
} else {
_cleanup_free_ void *p = NULL;
+ struct statvfs vfs;
ssize_t n;
+ if (fstatvfs(fd, &vfs) < 0) {
+ log_error_errno(errno, "Failed to stat file system of passed file, ignoring: %m");
+ return;
+ }
+
+ /* Refuse operating on file systems that have
+ * mandatory locking enabled, see:
+ *
+ * https://github.com/systemd/systemd/issues/1822
+ */
+ if (vfs.f_flag & ST_MANDLOCK) {
+ log_error("Received file descriptor from file system with mandatory locking enable, refusing.");
+ return;
+ }
+
+ /* Make the fd non-blocking. On regular files this has
+ * the effect of bypassing mandatory locking. Of
+ * course, this should normally not be necessary given
+ * the check above, but let's better be safe than
+ * sorry, after all NFS is pretty confusing regarding
+ * file system flags, and we better don't trust it,
+ * and so is SMB. */
+ r = fd_nonblock(fd, true);
+ if (r < 0) {
+ log_error_errno(r, "Failed to make fd non-blocking, ignoring: %m");
+ return;
+ }
+
/* The file is not sealed, we can't map the file here, since
* clients might then truncate it and trigger a SIGBUS for
* us. So let's stupidly read it */