Package: libvirt-daemon-system
Version: 2.1.0-2
Tags: patch
Hi,
virt-aa-helper segfaults when starting a VM with a read-only filesystem mount.
The issue is in line virt-aa-helper.c:774
> if ((sub = strchr(perms, 'R')) != NULL) {
> /* Don't write the invalid R permission, replace it with 'r' */
> sub[0] = 'r';
Esentially it overwrites parts of perms which is a const char* parameter.
Attached is a patch that fixes this issue. It first copies perms and then
modifies the local copy.
Cheers,
Felix
--- libvirt-2.1.0.orig/src/security/virt-aa-helper.c
+++ libvirt-2.1.0/src/security/virt-aa-helper.c
@@ -740,6 +740,7 @@ vah_add_path(virBufferPtr buf, const cha
bool readonly = true;
bool explicit_deny_rule = true;
char *sub = NULL;
+ char perms_fixed[32] = {0};
if (path == NULL)
return rc;
@@ -770,7 +770,12 @@ vah_add_path(virBufferPtr buf, const cha
explicit_deny_rule = false;
}
- if ((sub = strchr(perms, 'R')) != NULL) {
+ if (virStrcpyStatic(perms_fixed, perms) == NULL) {
+ vah_error(NULL, 0, path);
+ vah_error(NULL, 0, _("perms string is too long"));
+ return rc;
+ }
+ if ((sub = strchr(perms_fixed, 'R')) != NULL) {
/* Don't write the invalid R permission, replace it with 'r' */
sub[0] = 'r';
explicit_deny_rule = false;
@@ -788,7 +789,7 @@ vah_add_path(virBufferPtr buf, const cha
if (tmp[strlen(tmp) - 1] == '/')
tmp[strlen(tmp) - 1] = '\0';
- virBufferAsprintf(buf, " \"%s%s\" %s,\n", tmp, recursive ? "/**" : "", perms);
+ virBufferAsprintf(buf, " \"%s%s\" %s,\n", tmp, recursive ? "/**" : "", perms_fixed);
if (explicit_deny_rule) {
virBufferAddLit(buf, " # don't audit writes to readonly files\n");
virBufferAsprintf(buf, " deny \"%s%s\" w,\n", tmp, recursive ? "/**" : "");
