Introduce a --runas=<uid> flag to deprivilege pygrub on Linux and *BSDs. It
also implicitly creates a chroot env where it drops a deprivileged forked
process. The chroot itself is cleaned up at the end.
If the --runas arg is present, then pygrub forks, leaving the child to
deprivilege itself, and waiting for it to complete. When the child exists,
the parent performs cleanup and exits with the same error code.
This is roughly what the child does:
1. Initialize libfsimage (this loads every .so in memory so the chroot
can avoid bind-mounting /{,usr}/lib*
2. Create a temporary empty chroot directory
3. Mount tmpfs in it
4. Bind mount the disk inside, because libfsimage expects a path, not a
file descriptor.
5. Remount the root tmpfs to be stricter (ro,nosuid,nodev)
6. Set RLIMIT_FSIZE to a sensibly high amount (128 MiB)
7. Depriv gid, groups and uid
With this scheme in place, the "output" files are writable (up to
RLIMIT_FSIZE octets) and the exposed filesystem is immutable and contains
the single only file we can't easily get rid of (the disk).
If running on Linux, the child process also unshares mount, IPC, and
network namespaces before dropping its privileges.
This is part of XSA-443 / CVE-2023-34325
Signed-off-by: Alejandro Vallejo <alejandro.vallejo@cloud.com>
(cherry picked from commit e0342ae555)
This module should be called `libxenfsimage' for the same reasons that
the C library should.
Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
Acked-by: Wei Liu <wei.liu2@citrix.com>
`fsimage' is rather general. And we do not expect this library to be
very useful out of tree because of its unstable ABI.
So add the word `xen'. This will avoid naming conflicts with anyone
else's fsimage library.
Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
Acked-by: Wei Liu <wei.liu2@citrix.com>
which does not exist with python2.2, causing the following build
error:
make[2]: Entering directory `/home/muli/xen/x86.hg/tools/pygrub'
CFLAGS=" -m32 -march=i686" python setup.py build
Traceback (most recent call last):
File "setup.py", line 15, in ?
if cc.has_function("ext2fs_open2"):
AttributeError: UnixCCompiler instance has no attribute 'has_function'
The following patch gets it to build, but is pretty ugly. A proper fix
would be to do the check for ext2fs_open2() in a way that is backward
compatible with python2.2.
Signed-Off-By: Muli Ben-Yehuda <mulix@mulix.org>
to support having reading the boot loader config when you're using a
whole disk (eg, file:/root/disk.img,xvda,w) as opposed to just a
partition.
This reads the partition table in the MBR to find the active partition
and then passes that offset down into the filesystem reading code.
Signed-off-by: Jeremy Katz <katzj@redhat.com>
- pygrub/README provides information on packages needed to compile pygrub
- support reiserfs {2,3} filesystem
- dynamically build modules based on which filesystem libraries the
system has (proposed by Jeremy)
- pump up pygrub to version 0.2
Signed-off-by: Jeremy Katz <katzj@redhat.com>
Signed-off-by: Nguyen Anh Quynh <aquynh@gmail.com>
Alejandro Vallejo
Ian Jackson
Simon Rowe
Tim Deegan
kfraser@localhost.localdomain
kaf24@firebug.cl.cam.ac.uk
smh22@firebug.cl.cam.ac.uk
mjw@wray-m-3.hpl.hp.com