google / alioth / 42934065834

44%

push

github

fix(fuse): confine passthrough to the shared directory

A guest controls the file names in FUSE requests. Passthrough appended
them to the parent path with Path::join(), so an absolute name, e.g.
`/etc/passwd`, replaced the parent path, and a name with `..` walked
out of the shared directory. A malicious guest could thereby read,
write, create, delete, and rename any host file accessible to the VMM.

Reject file names that are empty, `.`, `..`, or contain `/`. Linux and
EDK2 do not send such names. Linux sends `.` and `..` only if
FUSE_EXPORT_SUPPORT is negotiated, which Passthrough does not do.

Also open files with O_NOFOLLOW in OPEN and CREATE, as LOOKUP and
GETATTR already do, so that a symbolic link in the shared directory
cannot redirect them to a file outside of it.

Fixes: 2c8e03d2bc43 ("feat(fuse): implement a naive passthrough fuse")
Fixes: 806a261fdb6c ("fix(fuse): open files in open() call")
Assisted-by: Jetski:Gemini
Signed-off-by: Changyuan Lyu <changyuanl@google.com>

973 of 1748 branches covered (55.66%)

Branch coverage included in aggregate %.

12 of 12 new or added lines in 2 files covered. (100.0%)

6966 of 16445 relevant lines covered (42.36%)

905.38 hits per line