mirror of
https://github.com/xen-project/xen.git
synced 2026-10-28 10:11:27 +01:00
Alejandro Vallejo
e0342ae555
Introduce a --runas=<uid> flag to deprivilege pygrub on Linux and *BSDs. It
also implicitly creates a chroot env where it drops a deprivileged forked
process. The chroot itself is cleaned up at the end.
If the --runas arg is present, then pygrub forks, leaving the child to
deprivilege itself, and waiting for it to complete. When the child exists,
the parent performs cleanup and exits with the same error code.
This is roughly what the child does:
1. Initialize libfsimage (this loads every .so in memory so the chroot
can avoid bind-mounting /{,usr}/lib*
2. Create a temporary empty chroot directory
3. Mount tmpfs in it
4. Bind mount the disk inside, because libfsimage expects a path, not a
file descriptor.
5. Remount the root tmpfs to be stricter (ro,nosuid,nodev)
6. Set RLIMIT_FSIZE to a sensibly high amount (128 MiB)
7. Depriv gid, groups and uid
With this scheme in place, the "output" files are writable (up to
RLIMIT_FSIZE octets) and the exposed filesystem is immutable and contains
the single only file we can't easily get rid of (the disk).
If running on Linux, the child process also unshares mount, IPC, and
network namespaces before dropping its privileges.
This is part of XSA-443 / CVE-2023-34325
Signed-off-by: Alejandro Vallejo <alejandro.vallejo@cloud.com>
32 lines
869 B
Python
32 lines
869 B
Python
# Prefer setuptools, fall back to distutils
|
|
try:
|
|
from setuptools import setup, Extension
|
|
except ImportError:
|
|
from distutils.core import setup, Extension
|
|
import os
|
|
import sys
|
|
|
|
extra_compile_args = [ "-fno-strict-aliasing" ]
|
|
|
|
XEN_ROOT = "../.."
|
|
|
|
xenfsimage = Extension("xenfsimage",
|
|
extra_compile_args = extra_compile_args,
|
|
include_dirs = [ XEN_ROOT + "/tools/libfsimage/common/" ],
|
|
library_dirs = [ XEN_ROOT + "/tools/libfsimage/common/" ],
|
|
libraries = ["xenfsimage"],
|
|
sources = ["src/fsimage/fsimage.c"])
|
|
|
|
pkgs = [ 'grub' ]
|
|
|
|
setup(name='pygrub',
|
|
version='0.7',
|
|
description='Boot loader that looks a lot like grub for Xen',
|
|
author='Jeremy Katz',
|
|
author_email='katzj@redhat.com',
|
|
license='GPL',
|
|
package_dir={'grub': 'src', 'fsimage': 'src'},
|
|
packages=pkgs,
|
|
ext_modules = [ xenfsimage ]
|
|
)
|