xenmon: Fix security vulnerability CVE-2007-3919.

The xenbaked daemon and xenmon utility communicate via a mmap'ed
shared file. Since this file is located in /tmp, unprivileged users
can cause arbitrary files to be truncated by creating a symlink from
the well-known /tmp filename to e.g., /etc/passwd.

The fix is to place the shared file in a directory to which only root
should have access (in this case /var/run/).

This bug was reported, and the fix suggested, by Steve Kemp
<skx@debian.org>. Thanks!

Signed-off-by: Keir Fraser <keir@xensource.com>
xen-unstable changeset:   16157:b28ae5f00553ea053bd4e4576634d8ea49e77bc3
xen-unstable date:        Tue Oct 23 09:26:43 2007 +0100

diff --git a/tools/xenmon/xenbaked.c b/tools/xenmon/xenbaked.c
index 5908a6c1c9abde2781848acf2901c0a319698088..aeedd0357e6bcd1968354ec5bf1176a04d3b4c86 100644 (file)
--- a/tools/xenmon/xenbaked.c
+++ b/tools/xenmon/xenbaked.c
@@ -593,7 +593,7 @@ error_t cmd_parser(int key, char *arg, struct argp_state *state)
     return 0;
 }
 
-#define SHARED_MEM_FILE "/tmp/xenq-shm"
+#define SHARED_MEM_FILE "/var/run/xenq-shm"
 void alloc_qos_data(int ncpu)
 {
     int i, n, pgsize, off=0;

diff --git a/tools/xenmon/xenmon.py b/tools/xenmon/xenmon.py
index 7f42bb9d448e3dd1a78cc8d3befbec293b85a6ab..37c1255238cff484d719decb662a88bc53084b41 100644 (file)
--- a/tools/xenmon/xenmon.py
+++ b/tools/xenmon/xenmon.py
@@ -46,7 +46,7 @@ ST_QDATA = "%dQ" % (6*NDOMAINS + 4)
 QOS_DATA_SIZE = struct.calcsize(ST_QDATA)*NSAMPLES + struct.calcsize(ST_DOM_INFO)*NDOMAINS + struct.calcsize("4i")
 
 # location of mmaped file, hard coded right now
-SHM_FILE = "/tmp/xenq-shm"
+SHM_FILE = "/var/run/xenq-shm"
 
 # format strings
 TOTALS = 15*' ' + "%6.2f%%" + 35*' ' + "%6.2f%%"