google / alioth / 42933589532

44%

main: 44%

Build Type

push

github

Committed by Lencerf

Commit Message

fix(fuse): confine passthrough to the shared directory

A guest controls the file names in FUSE requests. Passthrough appended
them to the parent path with Path::join(), so an absolute name, e.g.
`/etc/passwd`, replaced the parent path, and a name with `..` walked
out of the shared directory. A malicious guest could thereby read,
write, create, delete, and rename any host file accessible to the VMM.

Reject file names that are empty, `.`, `..`, or contain `/`. Linux and
EDK2 do not send such names. Linux sends `.` and `..` only if
FUSE_EXPORT_SUPPORT is negotiated, which Passthrough does not do.

Also open files with O_NOFOLLOW in OPEN and CREATE, as LOOKUP and
GETATTR already do, so that a symbolic link in the shared directory
cannot redirect them to a file outside of it.

Fixes: 2c8e03d2bc43 ("feat(fuse): implement a naive passthrough fuse")
Fixes: 806a261fdb6c ("fix(fuse): open files in open() call")
Assisted-by: Jetski:Gemini
Signed-off-by: Changyuan Lyu <changyuanl@google.com>

Coverage Stats

972 of 1748 branches covered (55.61%)

Branch coverage included in aggregate %.

12 of 12 new or added lines in 2 files covered. (100.0%)

1 existing line in 1 file now uncovered.

6967 of 16445 relevant lines covered (42.37%)

905.38 hits per line