[gentoo-commits] gentoo-x86 commit in sys-cluster/nova/files: CVE-2013-7130-stable-grizzly.patch CVE-2013-7130-stable-havana.patch

[Matt Thode (prometheanfire)]

prometheanfire    14/01/23 16:31:28

  Added:                CVE-2013-7130-stable-grizzly.patch
                        CVE-2013-7130-stable-havana.patch
  Log:
  fixes for CVE-2013-7130, old badness removed
  
  (Portage version: 2.2.7/cvs/Linux x86_64, signed Manifest commit with key 0x2471eb3e40ac5ac3)

Revision  Changes    Path
1.1                  sys-cluster/nova/files/CVE-2013-7130-stable-grizzly.patch

file : http://sources.gentoo.org/viewvc.cgi/gentoo-x86/sys-cluster/nova/files/CVE-2013-7130-stable-grizzly.patch?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewvc.cgi/gentoo-x86/sys-cluster/nova/files/CVE-2013-7130-stable-grizzly.patch?rev=1.1&content-type=text/plain

Index: CVE-2013-7130-stable-grizzly.patch
===================================================================
From 35e0ee309e040a95988a433120f1eba747f6f33c Mon Sep 17 00:00:00 2001
From: Nikola Dipanov <ndipanov@××××××.com>
Date: Tue, 10 Dec 2013 17:43:17 +0100
Subject: [PATCH] libvirt: Fix root disk leak in live mig

This patch makes sure that i_create_images_and_backing method of the
libvirt driver (called in several places, but most problematic one is
the call in the pre_live_migration method) creates all the files the
instance needs that are not present.

Prioir to this patch - the method would only attempt to download the
image, and if it did so with the path of the ephemeral drives, it could
expose the image to other users as an ephemeral devices. See the related
bug for more detaiis.

After this patch - we properly distinguish between image, ephemeral and
swap files, and make sure that the imagebackend does the correct thing.

Closes-bug: #1251590

Co-authored-by: Loganathan Parthipan <parthipan@××.com>

This patch also includes part of commit
65386c91910ee03d947c2b8bcc226a53c30e060a, not cherry-picked as a whole
due to the fact that it is a trivial change, and to avoud the
proliferation of patches needed to fix this bug.

Change-Id: I78aa2f4243899db4f4941e77014a7e18e27fc63e
(cherry picked from commit c69a619668b5f44e94a8fe1a23f3d887ba2834d7)

Conflicts:
	nova/tests/test_libvirt.py
	nova/virt/libvirt/driver.py
---
 nova/tests/test_libvirt.py  | 63 +++++++++++++++++++++++++++++++++++++++++++++
 nova/virt/libvirt/driver.py | 31 +++++++++++++++-------
 2 files changed, 85 insertions(+), 9 deletions(-)

diff --git a/nova/tests/test_libvirt.py b/nova/tests/test_libvirt.py
index d2ac73b..d9c7405 100644
--- a/nova/tests/test_libvirt.py
+++ b/nova/tests/test_libvirt.py
@@ -2346,6 +2346,69 @@ class LibvirtConnTestCase(test.TestCase):
 
         db.instance_destroy(self.context, instance_ref['uuid'])
 
+    def test_create_images_and_backing(self):
+        conn = libvirt_driver.LibvirtDriver(fake.FakeVirtAPI(), False)
+        self.mox.StubOutWithMock(conn, '_fetch_instance_kernel_ramdisk')
+        self.mox.StubOutWithMock(libvirt_driver.libvirt_utils, 'create_image')
+
+        libvirt_driver.libvirt_utils.create_image(mox.IgnoreArg(),
+                                                  mox.IgnoreArg(),
+                                                  mox.IgnoreArg())
+        conn._fetch_instance_kernel_ramdisk(self.context, self.test_instance)
+        self.mox.ReplayAll()
+
+        self.stubs.Set(os.path, 'exists', lambda *args: False)
+        disk_info_json = jsonutils.dumps([{'path': 'foo', 'type': None,
+                                           'disk_size': 0,
+                                           'backing_file': None}])
+        conn._create_images_and_backing(self.context, self.test_instance,
+                                        "/fake/instance/dir", disk_info_json)
+
+    def test_create_images_and_backing_ephemeral_gets_created(self):
+        conn = libvirt_driver.LibvirtDriver(fake.FakeVirtAPI(), False)
+        disk_info_json = jsonutils.dumps(
+            [{u'backing_file': u'fake_image_backing_file',
+              u'disk_size': 10747904,
+              u'path': u'disk_path',
+              u'type': u'qcow2',
+              u'virt_disk_size': 25165824},
+             {u'backing_file': u'ephemeral_1_default',
+              u'disk_size': 393216,
+              u'over_committed_disk_size': 1073348608,
+              u'path': u'disk_eph_path',
+              u'type': u'qcow2',
+              u'virt_disk_size': 1073741824}])
+
+        base_dir = os.path.join(CONF.instances_path, '_base')
+        ephemeral_target = os.path.join(base_dir, 'ephemeral_1_default')
+        image_target = os.path.join(base_dir, 'fake_image_backing_file')
+        self.test_instance.update({'name': 'fake_instance',
+                                   'user_id': 'fake-user',
+                                   'os_type': None,
+                                   'project_id': 'fake-project'})
+
+        self.mox.StubOutWithMock(libvirt_driver.libvirt_utils, 'fetch_image')
+        self.mox.StubOutWithMock(conn, '_create_ephemeral')
+        self.mox.StubOutWithMock(conn, '_fetch_instance_kernel_ramdisk')
+
+        conn._create_ephemeral(
+                target=ephemeral_target,
+                ephemeral_size=self.test_instance['ephemeral_gb'],
+                max_size=mox.IgnoreArg(), os_type=mox.IgnoreArg(),
+                fs_label=mox.IgnoreArg())
+        libvirt_driver.libvirt_utils.fetch_image(context=self.context,
+                image_id=mox.IgnoreArg(),
+                user_id=mox.IgnoreArg(), project_id=mox.IgnoreArg(),
+                max_size=mox.IgnoreArg(), target=image_target)
+        conn._fetch_instance_kernel_ramdisk(
+                self.context, self.test_instance).AndReturn(None)
+
+        self.mox.ReplayAll()
+
+        conn._create_images_and_backing(self.context, self.test_instance,
+                                        "/fake/instance/dir",
+                                        disk_info_json)
+
     def test_pre_live_migration_works_correctly_mocked(self):
         # Creating testdata
         vol = {'block_device_mapping': [
diff --git a/nova/virt/libvirt/driver.py b/nova/virt/libvirt/driver.py
index 0f0ea46..39191af 100755
--- a/nova/virt/libvirt/driver.py
+++ b/nova/virt/libvirt/driver.py
@@ -3304,19 +3304,32 @@ class LibvirtDriver(driver.ComputeDriver):
             elif info['backing_file']:
                 # Creating backing file follows same way as spawning instances.
                 cache_name = os.path.basename(info['backing_file'])
-                # Remove any size tags which the cache manages
-                cache_name = cache_name.split('_')[0]
 
                 image = self.image_backend.image(instance,
                                                  instance_disk,
                                                  CONF.libvirt_images_type)
-                image.cache(fetch_func=libvirt_utils.fetch_image,
-                            context=ctxt,
-                            filename=cache_name,
-                            image_id=instance['image_ref'],
-                            user_id=instance['user_id'],
-                            project_id=instance['project_id'],
-                            size=info['virt_disk_size'])
+                if cache_name.startswith('ephemeral'):
+                    image.cache(fetch_func=self._create_ephemeral,
+                                fs_label=cache_name,
+                                os_type=instance["os_type"],
+                                filename=cache_name,
+                                size=info['virt_disk_size'],
+                                ephemeral_size=instance['ephemeral_gb'])
+                elif cache_name.startswith('swap'):
+                    inst_type = flavors.extract_flavor(instance)
+                    swap_mb = inst_type['swap']
+                    image.cache(fetch_func=self._create_swap,
+                                filename="swap_%s" % swap_mb,
+                                size=swap_mb * unit.Mi,
+                                swap_mb=swap_mb)
+                else:
+                    image.cache(fetch_func=libvirt_utils.fetch_image,
+                                context=ctxt,
+                                filename=cache_name,
+                                image_id=instance['image_ref'],
+                                user_id=instance['user_id'],
+                                project_id=instance['project_id'],
+                                size=info['virt_disk_size'])
 
         # if image has kernel and ramdisk, just download
         # following normal way.
-- 
1.8.3.1




1.1                  sys-cluster/nova/files/CVE-2013-7130-stable-havana.patch

file : http://sources.gentoo.org/viewvc.cgi/gentoo-x86/sys-cluster/nova/files/CVE-2013-7130-stable-havana.patch?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewvc.cgi/gentoo-x86/sys-cluster/nova/files/CVE-2013-7130-stable-havana.patch?rev=1.1&content-type=text/plain

Index: CVE-2013-7130-stable-havana.patch
===================================================================
From c8423d648d578397e2742f9d0b21c90171e2efc3 Mon Sep 17 00:00:00 2001
From: Nikola Dipanov <ndipanov@××××××.com>
Date: Tue, 10 Dec 2013 17:43:17 +0100
Subject: [PATCH] libvirt: Fix root disk leak in live mig

This patch makes sure that i_create_images_and_backing method of the
libvirt driver (called in several places, but most problematic one is
the call in the pre_live_migration method) creates all the files the
instance needs that are not present.

Prioir to this patch - the method would only attempt to download the
image, and if it did so with the path of the ephemeral drives, it could
expose the image to other users as an ephemeral devices. See the related
bug for more detaiis.

After this patch - we properly distinguish between image, ephemeral and
swap files, and make sure that the imagebackend does the correct thing.

Closes-bug: #1251590

Co-authored-by: Loganathan Parthipan <parthipan@××.com>

Change-Id: I78aa2f4243899db4f4941e77014a7e18e27fc63e
(cherry picked from commit c69a619668b5f44e94a8fe1a23f3d887ba2834d7)

Conflicts:
	nova/virt/libvirt/driver.py
---
 nova/tests/virt/libvirt/test_libvirt.py | 42 +++++++++++++++++++++++++++++++++
 nova/virt/libvirt/driver.py             | 31 +++++++++++++++++-------
 2 files changed, 65 insertions(+), 8 deletions(-)

diff --git a/nova/tests/virt/libvirt/test_libvirt.py b/nova/tests/virt/libvirt/test_libvirt.py
index c176985..191b3f8 100644
--- a/nova/tests/virt/libvirt/test_libvirt.py
+++ b/nova/tests/virt/libvirt/test_libvirt.py
@@ -3047,6 +3047,48 @@ class LibvirtConnTestCase(test.TestCase):
         conn._create_images_and_backing(self.context, self.test_instance,
                                         "/fake/instance/dir", disk_info_json)
 
+    def test_create_images_and_backing_ephemeral_gets_created(self):
+        conn = libvirt_driver.LibvirtDriver(fake.FakeVirtAPI(), False)
+        disk_info_json = jsonutils.dumps(
+            [{u'backing_file': u'fake_image_backing_file',
+              u'disk_size': 10747904,
+              u'path': u'disk_path',
+              u'type': u'qcow2',
+              u'virt_disk_size': 25165824},
+             {u'backing_file': u'ephemeral_1_default',
+              u'disk_size': 393216,
+              u'over_committed_disk_size': 1073348608,
+              u'path': u'disk_eph_path',
+              u'type': u'qcow2',
+              u'virt_disk_size': 1073741824}])
+
+        base_dir = os.path.join(CONF.instances_path,
+                                CONF.image_cache_subdirectory_name)
+        self.test_instance.update({'name': 'fake_instance',
+                                   'user_id': 'fake-user',
+                                   'os_type': None,
+                                   'project_id': 'fake-project'})
+
+        with contextlib.nested(
+            mock.patch.object(conn, '_fetch_instance_kernel_ramdisk'),
+            mock.patch.object(libvirt_driver.libvirt_utils, 'fetch_image'),
+            mock.patch.object(conn, '_create_ephemeral')
+        ) as (fetch_kernel_ramdisk_mock, fetch_image_mock,
+                create_ephemeral_mock):
+            conn._create_images_and_backing(self.context, self.test_instance,
+                                            "/fake/instance/dir",
+                                            disk_info_json)
+            self.assertEqual(len(create_ephemeral_mock.call_args_list), 1)
+            m_args, m_kwargs = create_ephemeral_mock.call_args_list[0]
+            self.assertEqual(
+                    os.path.join(base_dir, 'ephemeral_1_default'),
+                    m_kwargs['target'])
+            self.assertEqual(len(fetch_image_mock.call_args_list), 1)
+            m_args, m_kwargs = fetch_image_mock.call_args_list[0]
+            self.assertEqual(
+                    os.path.join(base_dir, 'fake_image_backing_file'),
+                    m_kwargs['target'])
+
     def test_create_images_and_backing_disk_info_none(self):
         conn = libvirt_driver.LibvirtDriver(fake.FakeVirtAPI(), False)
         self.mox.StubOutWithMock(conn, '_fetch_instance_kernel_ramdisk')
diff --git a/nova/virt/libvirt/driver.py b/nova/virt/libvirt/driver.py
index 500ce51..c74b2ad 100644
--- a/nova/virt/libvirt/driver.py
+++ b/nova/virt/libvirt/driver.py
@@ -4209,14 +4209,29 @@ class LibvirtDriver(driver.ComputeDriver):
 
                 image = self.image_backend.image(instance,
                                                  instance_disk,
-                                                 CONF.libvirt_images_type)
-                image.cache(fetch_func=libvirt_utils.fetch_image,
-                            context=context,
-                            filename=cache_name,
-                            image_id=instance['image_ref'],
-                            user_id=instance['user_id'],
-                            project_id=instance['project_id'],
-                            size=info['virt_disk_size'])
+                                                 CONF.libvirt.images_type)
+                if cache_name.startswith('ephemeral'):
+                    image.cache(fetch_func=self._create_ephemeral,
+                                fs_label=cache_name,
+                                os_type=instance["os_type"],
+                                filename=cache_name,
+                                size=info['virt_disk_size'],
+                                ephemeral_size=instance['ephemeral_gb'])
+                elif cache_name.startswith('swap'):
+                    inst_type = flavors.extract_flavor(instance)
+                    swap_mb = inst_type['swap']
+                    image.cache(fetch_func=self._create_swap,
+                                filename="swap_%s" % swap_mb,
+                                size=swap_mb * unit.Mi,
+                                swap_mb=swap_mb)
+                else:
+                    image.cache(fetch_func=libvirt_utils.fetch_image,
+                                context=context,
+                                filename=cache_name,
+                                image_id=instance['image_ref'],
+                                user_id=instance['user_id'],
+                                project_id=instance['project_id'],
+                                size=info['virt_disk_size'])
 
         # if image has kernel and ramdisk, just download
         # following normal way.
-- 
1.8.3.1