7869cf1d65
Fix bug 1015531, CVE-2012-3360, CVE-2012-3361 This patch prevents the file injection code from writing into the host filesystem if a user specifies a path for the injected file that contains '..'. The check is to make sure that the final normalized path that is about to be written to is within the mounted guest filesystem. Signed-off-by: Russell Bryant <rbryant@redhat.com> Signed-off-by: Pádraig Brady <pbrady@redhat.com> Signed-off-by: Mark McLoughlin <markmc@redhat.com> Change-Id: I658cd12fd319cee91eb9544cdf53c862c5d2c560
104 lines
4.0 KiB
Python
104 lines
4.0 KiB
Python
# vim: tabstop=4 shiftwidth=4 softtabstop=4
|
|
|
|
# Copyright 2011 Isaku Yamahata
|
|
# All Rights Reserved.
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
|
# not use this file except in compliance with the License. You may obtain
|
|
# a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
|
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
|
# License for the specific language governing permissions and limitations
|
|
# under the License.
|
|
|
|
from nova import exception
|
|
from nova import flags
|
|
from nova import test
|
|
from nova.virt.disk import api as disk_api
|
|
from nova.virt import driver
|
|
|
|
FLAGS = flags.FLAGS
|
|
|
|
|
|
class TestVirtDriver(test.TestCase):
|
|
def test_block_device(self):
|
|
swap = {'device_name': '/dev/sdb',
|
|
'swap_size': 1}
|
|
ephemerals = [{'num': 0,
|
|
'virtual_name': 'ephemeral0',
|
|
'device_name': '/dev/sdc1',
|
|
'size': 1}]
|
|
block_device_mapping = [{'mount_device': '/dev/sde',
|
|
'device_path': 'fake_device'}]
|
|
block_device_info = {
|
|
'root_device_name': '/dev/sda',
|
|
'swap': swap,
|
|
'ephemerals': ephemerals,
|
|
'block_device_mapping': block_device_mapping}
|
|
|
|
empty_block_device_info = {}
|
|
|
|
self.assertEqual(
|
|
driver.block_device_info_get_root(block_device_info), '/dev/sda')
|
|
self.assertEqual(
|
|
driver.block_device_info_get_root(empty_block_device_info), None)
|
|
self.assertEqual(
|
|
driver.block_device_info_get_root(None), None)
|
|
|
|
self.assertEqual(
|
|
driver.block_device_info_get_swap(block_device_info), swap)
|
|
self.assertEqual(driver.block_device_info_get_swap(
|
|
empty_block_device_info)['device_name'], None)
|
|
self.assertEqual(driver.block_device_info_get_swap(
|
|
empty_block_device_info)['swap_size'], 0)
|
|
self.assertEqual(
|
|
driver.block_device_info_get_swap({'swap': None})['device_name'],
|
|
None)
|
|
self.assertEqual(
|
|
driver.block_device_info_get_swap({'swap': None})['swap_size'],
|
|
0)
|
|
self.assertEqual(
|
|
driver.block_device_info_get_swap(None)['device_name'], None)
|
|
self.assertEqual(
|
|
driver.block_device_info_get_swap(None)['swap_size'], 0)
|
|
|
|
self.assertEqual(
|
|
driver.block_device_info_get_ephemerals(block_device_info),
|
|
ephemerals)
|
|
self.assertEqual(
|
|
driver.block_device_info_get_ephemerals(empty_block_device_info),
|
|
[])
|
|
self.assertEqual(
|
|
driver.block_device_info_get_ephemerals(None),
|
|
[])
|
|
|
|
def test_swap_is_usable(self):
|
|
self.assertFalse(driver.swap_is_usable(None))
|
|
self.assertFalse(driver.swap_is_usable({'device_name': None}))
|
|
self.assertFalse(driver.swap_is_usable({'device_name': '/dev/sdb',
|
|
'swap_size': 0}))
|
|
self.assertTrue(driver.swap_is_usable({'device_name': '/dev/sdb',
|
|
'swap_size': 1}))
|
|
|
|
|
|
class TestVirtDisk(test.TestCase):
|
|
def test_check_safe_path(self):
|
|
ret = disk_api._join_and_check_path_within_fs('/foo', 'etc',
|
|
'something.conf')
|
|
self.assertEquals(ret, '/foo/etc/something.conf')
|
|
|
|
def test_check_unsafe_path(self):
|
|
self.assertRaises(exception.Invalid,
|
|
disk_api._join_and_check_path_within_fs,
|
|
'/foo', 'etc/../../../something.conf')
|
|
|
|
def test_inject_files_with_bad_path(self):
|
|
self.assertRaises(exception.Invalid,
|
|
disk_api._inject_file_into_fs,
|
|
'/tmp', '/etc/../../../../etc/passwd',
|
|
'hax')
|