CVE-2013-6456: Avoid unsafe use of /proc/$PID/root in LXC chardev hostdev hotplug
authorDaniel P. Berrange <berrange@redhat.com>
Thu, 30 Jan 2014 17:47:39 +0000 (17:47 +0000)
committerDaniel P. Berrange <berrange@redhat.com>
Tue, 18 Feb 2014 21:36:38 +0000 (21:36 +0000)
commit84cf9af8d9a803f2e12df0b8b0c2bd2de544cf93
tree09929718d287030daeccb92f71020603ceb3a9d5
parentf8706947b86e6de2961aacddb5eb2345d9c033b4
CVE-2013-6456: Avoid unsafe use of /proc/$PID/root in LXC chardev hostdev hotplug

Rewrite lxcDomainAttachDeviceHostdevMiscLive function
to use the virProcessRunInMountNamespace helper. This avoids
risk of a malicious guest replacing /dev with a absolute
symlink, tricking the driver into changing the host OS
filesystem.

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
(cherry picked from commit 1cadeafcaa422844a27ef622e2a7041d0235bcb3)

Conflicts:
src/lxc/lxc_driver.c: OOM + cgroups error reporting
src/lxc/lxc_driver.c