gian/incus-mirror
1
0
Fork 0
mirror of https://github.com/lxc/incus synced 2026-08-02 05:26:46 +00:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

incusd/instance/lxc: Confine credentials write to credentials directory

Browse Source 
systemd credentials name could be abused to escape the credentials
folder and allow for arbitrary writes to the host filesystem allowing
for privilege escalation and denial of service attacks.

We now use Go's OpenRoot (openat2) to restrict all file interactions to
the "credentials" directory, avoiding such attacks.

This addresses CVE-2026-33945

Reported-by: https://7asecurity.com
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
This commit is contained in:
Stéphane Graber 2026-03-24 21:19:28 -04:00
parent 15a5344774
commit d0f2c86fcb
No known key found for this signature in database
GPG Key ID: C638974D64792D67
1 changed files with 10 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
internal/server/instance/drivers/driver_lxc.go
View File

@ -9236,16 +9236,22 @@ func (d *lxc) setupCredentials(update bool) error {
}
}
credsRoot, err := os.OpenRoot(credentialsDir)
if err != nil {
return fmt.Errorf("Failed to open the credentials directory: %w", err)
}
defer func() { _ = credsRoot.Close() }()
for k, v := range credentials {
credentialPath := filepath.Join(credentialsDir, k)
err := os.WriteFile(credentialPath, v, 0o400)
err := credsRoot.WriteFile(k, v, 0o400)
if err != nil {
return fmt.Errorf("Failed to write credential %q: %w", k, err)
}
err = os.Chown(credentialPath, int(rootUID), int(rootGID))
err = credsRoot.Chown(k, int(rootUID), int(rootGID))
if err != nil {
return fmt.Errorf("Failed setting permissions for file %q: %w", credentialPath, err)
return fmt.Errorf("Failed setting permissions for file %q: %w", k, err)
}
delete(oldCredentials, k)