On 9/13/19 5:23 PM, Daniel P. Berrangé wrote:
On Fri, Sep 13, 2019 at 05:13:09PM +0200, Michal Privoznik wrote:
On 9/5/19 1:56 PM, Daniel P. Berrangé wrote:
When opening a connection to a second driver inside the daemon, we must
ensure the identity of the current user is passed across. This allows
the second daemon to perform access control checks against the real end
users, instead of against the libvirt daemon that's proxying across the
API calls.
Signed-off-by: Daniel P. Berrangé <berrange@xxxxxxxxxx>
---
src/libvirt_remote.syms | 1 +
src/remote/remote_daemon_dispatch.c | 112 +++++++++++++++++++++++++---
src/remote/remote_driver.c | 1 +
src/remote/remote_protocol.x | 16 +++-
src/remote_protocol-structs | 8 ++
src/rpc/virnetserverclient.c | 12 +++
src/rpc/virnetserverclient.h | 2 +
7 files changed, 139 insertions(+), 13 deletions(-)
/* Define the program number, protocol version and procedure numbers here. */
@@ -6603,5 +6611,11 @@ enum remote_procedure {
* @generate: none
* @acl: domain:write
*/
- REMOTE_PROC_DOMAIN_GET_GUEST_INFO = 418
+ REMOTE_PROC_DOMAIN_GET_GUEST_INFO = 418,
+
+ /**
+ * @generate: client
+ * @acl: connect:write
+ */
+ REMOTE_PROC_CONNECT_SET_IDENTITY = 419
IIUC, the only thing that stops a malicious user from switching identity is
that they have write access on the opened connection?
We consider 'write' access as equivalent to root shell access, but perhaps
there is none the less value in having an explicit permission bit for this
operation.
Agreed, you can post it in as a follow up patch.
Because on one hand we want secondary daemons to accept identity switches
from the proxy daemon, but at the same time we don't want users to do that.
In an out of the box config with no ACLs defined in polkit, this will
correctly operate. the proxy will get approved by default since it is
runnig root & thus polkit grants access regardless. Everything else
is denied by default.
If polkit is not enabled, then the user can invoke this RPC, but of
course without polkit your privileges are again eqiuv to root.
Right, this is exactly what I though. Alright,
Reviewed-by: Michal Privoznik <mprivozn@xxxxxxxxxx> to the whole patchset.
Michal
--
libvir-list mailing list
libvir-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/libvir-list
