forked from pool/libvirt
42 lines
1.5 KiB
Diff
42 lines
1.5 KiB
Diff
|
commit e37bd65f9948c1185456b2cdaa3bd6e875af680f
|
||
|
|
Author: Daniel P. Berrangé <berrange@redhat.com>
|
||
|
|
Date: Tue Apr 30 17:27:41 2019 +0100
|
||
|
|
|
||
|
|
logging: restrict sockets to mode 0600
|
||
|
|
|
||
|
|
The virtlogd daemon's only intended client is the libvirtd daemon. As
|
||
|
|
such it should never allow clients from other user accounts to connect.
|
||
|
|
The code already enforces this and drops clients from other UIDs, but
|
||
|
|
we can get earlier (and thus stronger) protection against DoS by setting
|
||
|
|
the socket permissions to 0600
|
||
|
|
|
||
|
|
Fixes CVE-2019-10132
|
||
|
|
|
||
|
|
Reviewed-by: Ján Tomko <jtomko@redhat.com>
|
||
|
|
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
|
||
|
|
|
||
|
|
Index: libvirt-5.3.0/src/logging/virtlogd-admin.socket.in
|
||
|
|
===================================================================
|
||
|
|
--- libvirt-5.3.0.orig/src/logging/virtlogd-admin.socket.in
|
||
|
|
+++ libvirt-5.3.0/src/logging/virtlogd-admin.socket.in
|
||
|
|
@@ -5,6 +5,7 @@ Before=libvirtd.service
|
||
|
|
[Socket]
|
||
|
|
ListenStream=@localstatedir@/run/libvirt/virtlogd-admin-sock
|
||
|
|
Service=virtlogd.service
|
||
|
|
+SocketMode=0600
|
||
|
|
|
||
|
|
[Install]
|
||
|
|
WantedBy=sockets.target
|
||
|
|
Index: libvirt-5.3.0/src/logging/virtlogd.socket.in
|
||
|
|
===================================================================
|
||
|
|
--- libvirt-5.3.0.orig/src/logging/virtlogd.socket.in
|
||
|
|
+++ libvirt-5.3.0/src/logging/virtlogd.socket.in
|
||
|
|
@@ -4,6 +4,7 @@ Before=libvirtd.service
|
||
|
|
|
||
|
|
[Socket]
|
||
|
|
ListenStream=@localstatedir@/run/libvirt/virtlogd-sock
|
||
|
|
+SocketMode=0600
|
||
|
|
|
||
|
|
[Install]
|
||
|
|
WantedBy=sockets.target
|