mirror of
https://github.com/xen-project/xen.git
synced 2026-10-28 18:21:39 +01:00
Alejandro Vallejo
e0342ae555
Introduce a --runas=<uid> flag to deprivilege pygrub on Linux and *BSDs. It
also implicitly creates a chroot env where it drops a deprivileged forked
process. The chroot itself is cleaned up at the end.
If the --runas arg is present, then pygrub forks, leaving the child to
deprivilege itself, and waiting for it to complete. When the child exists,
the parent performs cleanup and exits with the same error code.
This is roughly what the child does:
1. Initialize libfsimage (this loads every .so in memory so the chroot
can avoid bind-mounting /{,usr}/lib*
2. Create a temporary empty chroot directory
3. Mount tmpfs in it
4. Bind mount the disk inside, because libfsimage expects a path, not a
file descriptor.
5. Remount the root tmpfs to be stricter (ro,nosuid,nodev)
6. Set RLIMIT_FSIZE to a sensibly high amount (128 MiB)
7. Depriv gid, groups and uid
With this scheme in place, the "output" files are writable (up to
RLIMIT_FSIZE octets) and the exposed filesystem is immutable and contains
the single only file we can't easily get rid of (the disk).
If running on Linux, the child process also unshares mount, IPC, and
network namespaces before dropping its privileges.
This is part of XSA-443 / CVE-2023-34325
Signed-off-by: Alejandro Vallejo <alejandro.vallejo@cloud.com>
pygrub is a grub-like bootloader for xen. This tool is to use to boot domU images. To compile pygrub, you will need the following packages installed: 1) Libraries of ext2fs, which is the following package (depend on your Linux distribution): - e2fslibs-dev on Debian based distributions (Debian, Ubuntu, Linspire, Libranet, Xandros, etc...) - e2fsprogs-devel on RedHat, Fedora Core - libext2fs2-devel on Mandriva/Mandrake - e2fsprogs on Gentoo 2) Libraries of reiserfs, which is the following package (depend on your Linux distribution): - libreiserfs-dev on Debian based distributions (Debian, Ubuntu, Xandros, Libranet, Xandros, etc...) - progsreiserfs-devel on RedHat - progsreiserfs on Gentoo