From d0f2c86fcb4a7d38343807c83ea3541bb4661e1e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?St=C3=A9phane=20Graber?= Date: Tue, 24 Mar 2026 21:19:28 -0400 Subject: [PATCH] incusd/instance/lxc: Confine credentials write to credentials directory MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit systemd credentials name could be abused to escape the credentials folder and allow for arbitrary writes to the host filesystem allowing for privilege escalation and denial of service attacks. We now use Go's OpenRoot (openat2) to restrict all file interactions to the "credentials" directory, avoiding such attacks. This addresses CVE-2026-33945 Reported-by: https://7asecurity.com Signed-off-by: Stéphane Graber --- internal/server/instance/drivers/driver_lxc.go | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/internal/server/instance/drivers/driver_lxc.go b/internal/server/instance/drivers/driver_lxc.go index fc6ffa77a1..ef69b73efd 100644 --- a/internal/server/instance/drivers/driver_lxc.go +++ b/internal/server/instance/drivers/driver_lxc.go @@ -9236,16 +9236,22 @@ func (d *lxc) setupCredentials(update bool) error { } } + credsRoot, err := os.OpenRoot(credentialsDir) + if err != nil { + return fmt.Errorf("Failed to open the credentials directory: %w", err) + } + + defer func() { _ = credsRoot.Close() }() + for k, v := range credentials { - credentialPath := filepath.Join(credentialsDir, k) - err := os.WriteFile(credentialPath, v, 0o400) + err := credsRoot.WriteFile(k, v, 0o400) if err != nil { return fmt.Errorf("Failed to write credential %q: %w", k, err) } - err = os.Chown(credentialPath, int(rootUID), int(rootGID)) + err = credsRoot.Chown(k, int(rootUID), int(rootGID)) if err != nil { - return fmt.Errorf("Failed setting permissions for file %q: %w", credentialPath, err) + return fmt.Errorf("Failed setting permissions for file %q: %w", k, err) } delete(oldCredentials, k)