[Top][All Lists]
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [Bug 807893] Re: qemu privilege escalation
From: |
Andrew Griffiths |
Subject: |
[Qemu-devel] [Bug 807893] Re: qemu privilege escalation |
Date: |
Wed, 13 Jul 2011 10:00:07 -0000 |
# ps axwu
...
qemu00 29957 0.5 9.8 480568 405228 ? Sl Jul12 7:41
/usr/bin/qemu-system-x86_64 -runas ...
...
# ps axwu -L
...
qemu00 29957 29957 0.2 3 9.8 480568 405228 ? Sl Jul12 2:49
/usr/bin/qemu-system-x86_64 -runas ...
root 29957 29959 0.3 3 9.8 480568 405228 ? Sl Jul12 4:47
/usr/bin/qemu-system-x86_64 -runas ...
root 29957 29960 0.0 3 9.8 480568 405228 ? Sl Jul12 0:00
/usr/bin/qemu-system-x86_64 -runas ...
...
# cat /proc/29957/task/29959/status
Name: qemu-system-x86
State: S (sleeping)
Tgid: 29957
Pid: 29959
PPid: 1
TracerPid: 0
Uid: 0 0 0 0
Gid: 0 0 0 0
FDSize: 32
Groups: 999
...
Threads can have their own uid/gid set.
--
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/807893
Title:
qemu privilege escalation
Status in QEMU:
Confirmed
Bug description:
If qemu is started as root, with -runas, the extra groups is not
dropped correctly
/proc/`pidof qemu`/status
..
Uid: 100 100 100 100
Gid: 100 100 100 100
FDSize: 32
Groups: 0 1 2 3 4 6 10 11 26 27
...
The fix is to add initgroups() or setgroups(1, [gid]) where
appropriate to os-posix.c.
The extra gid's allow read or write access to other files (such as
/dev etc).
Emulating the qemu code:
# python
...
>>> import os
>>> os.setgid(100)
>>> os.setuid(100)
>>> os.execve("/bin/sh", [ "/bin/sh" ], os.environ)
sh-4.1$ xxd /dev/sda | head -n2
0000000: eb48 9000 0000 0000 0000 0000 0000 0000 .H..............
0000010: 0000 0000 0000 0000 0000 0000 0000 0000 ................
sh-4.1$ ls -l /dev/sda
brw-rw---- 1 root disk 8, 0 Jul 8 11:54 /dev/sda
sh-4.1$ id
uid=100(qemu00) gid=100(users)
groups=100(users),0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),11(floppy),26(tape),27(video)
To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/807893/+subscriptions
[Prev in Thread] |
Current Thread |
[Next in Thread] |