dilim/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd.git synced 2026-08-03 06:30:30 +00:00
Code Issues Packages Projects Releases Wiki Activity

core: only allow systemd-oomd to use SubscribeManagedOOMCGroups

Browse Source 
Attempt to address
https://github.com/systemd/systemd/issues/20330#issuecomment-1210028422.

Summary of the comment: Unprivileged users can potentially cause a denial of
service during systemd-oomd unit subscriptions by spamming requests to
SubscribeManagedOOMCGroups. As systemd-oomd.service is the only unit that
should be accessing this method, add a check on the caller's unit name to deter
them from successfully using this method.
This commit is contained in:
Anita Zhang
2022-10-05 01:40:40 -07:00
parent 008798e90c
commit 284212893b
2 changed files with 16 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
src/core/core-varlink.c
View File

@@ -203,10 +203,25 @@ static int vl_method_subscribe_managed_oom_cgroups(
_cleanup_(json_variant_unrefp) JsonVariant *v = NULL;
Manager *m = ASSERT_PTR(userdata);
pid_t pid;
Unit *u;
int r;
assert(link);
r = varlink_get_peer_pid(link, &pid);
if (r < 0)
return r;
u = manager_get_unit_by_pid(m, pid);
if (!u)
return varlink_error(link, VARLINK_ERROR_PERMISSION_DENIED, NULL);
/* This is meant to be a deterrent and not actual security. The alternative is to check for the systemd-oom
* user that this unit runs as, but NSS lookups are blocking and not allowed from PID 1. */
if (!streq(u->id, "systemd-oomd.service"))
return varlink_error(link, VARLINK_ERROR_PERMISSION_DENIED, NULL);
if (json_variant_elements(parameters) > 0)
return varlink_error_invalid_parameter(link, parameters);

1
src/shared/varlink.h
View File

@@ -173,3 +173,4 @@ DEFINE_TRIVIAL_CLEANUP_FUNC(VarlinkServer *, varlink_server_unref);
#define VARLINK_ERROR_METHOD_NOT_IMPLEMENTED "org.varlink.service.MethodNotImplemented"
#define VARLINK_ERROR_INVALID_PARAMETER "org.varlink.service.InvalidParameter"
#define VARLINK_ERROR_SUBSCRIPTION_TAKEN "org.varlink.service.SubscriptionTaken"
#define VARLINK_ERROR_PERMISSION_DENIED "org.varlink.service.PermissionDenied"