Introduce a --runas=<uid> flag to deprivilege pygrub on Linux and *BSDs. It
also implicitly creates a chroot env where it drops a deprivileged forked
process. The chroot itself is cleaned up at the end.
If the --runas arg is present, then pygrub forks, leaving the child to
deprivilege itself, and waiting for it to complete. When the child exists,
the parent performs cleanup and exits with the same error code.
This is roughly what the child does:
1. Initialize libfsimage (this loads every .so in memory so the chroot
can avoid bind-mounting /{,usr}/lib*
2. Create a temporary empty chroot directory
3. Mount tmpfs in it
4. Bind mount the disk inside, because libfsimage expects a path, not a
file descriptor.
5. Remount the root tmpfs to be stricter (ro,nosuid,nodev)
6. Set RLIMIT_FSIZE to a sensibly high amount (128 MiB)
7. Depriv gid, groups and uid
With this scheme in place, the "output" files are writable (up to
RLIMIT_FSIZE octets) and the exposed filesystem is immutable and contains
the single only file we can't easily get rid of (the disk).
If running on Linux, the child process also unshares mount, IPC, and
network namespaces before dropping its privileges.
This is part of XSA-443 / CVE-2023-34325
Signed-off-by: Alejandro Vallejo <alejandro.vallejo@cloud.com>
Python distutils is deprecated and is going to be removed in Python
3.12. Add support for setuptools.
Setuptools in Python 3.11 complains:
SetuptoolsDeprecationWarning: setup.py install is deprecated. Use build and pip and other standards-based tools.
Keep using setup.py anyway to build the C extension.
Signed-off-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
Signed-off-by: Javi Merino <javi.merino@cloud.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
This is mandated by the Fedora packaging guidelines because it is a security
vulnerability otherwise in suid scripts. While Xen doesn't have suid scripts,
it's a very good idea generally because it prevents the users local python
environment interfering from system packaged scripts.
pygrub is the odd-script-out, being installed by distutils rather than
manually with INSTALL_PYTHON_PROG. distutils has no nice way of editing the
shebang, so arrange to use INSTALL_PYTHON_PROG for pygrub too.
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Acked-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
This module should be called `libxenfsimage' for the same reasons that
the C library should.
Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
Acked-by: Wei Liu <wei.liu2@citrix.com>
`fsimage' is rather general. And we do not expect this library to be
very useful out of tree because of its unstable ABI.
So add the word `xen'. This will avoid naming conflicts with anyone
else's fsimage library.
Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
Acked-by: Wei Liu <wei.liu2@citrix.com>
which does not exist with python2.2, causing the following build
error:
make[2]: Entering directory `/home/muli/xen/x86.hg/tools/pygrub'
CFLAGS=" -m32 -march=i686" python setup.py build
Traceback (most recent call last):
File "setup.py", line 15, in ?
if cc.has_function("ext2fs_open2"):
AttributeError: UnixCCompiler instance has no attribute 'has_function'
The following patch gets it to build, but is pretty ugly. A proper fix
would be to do the check for ext2fs_open2() in a way that is backward
compatible with python2.2.
Signed-Off-By: Muli Ben-Yehuda <mulix@mulix.org>
to support having reading the boot loader config when you're using a
whole disk (eg, file:/root/disk.img,xvda,w) as opposed to just a
partition.
This reads the partition table in the MBR to find the active partition
and then passes that offset down into the filesystem reading code.
Signed-off-by: Jeremy Katz <katzj@redhat.com>
- pygrub/README provides information on packages needed to compile pygrub
- support reiserfs {2,3} filesystem
- dynamically build modules based on which filesystem libraries the
system has (proposed by Jeremy)
- pump up pygrub to version 0.2
Signed-off-by: Jeremy Katz <katzj@redhat.com>
Signed-off-by: Nguyen Anh Quynh <aquynh@gmail.com>
