The following pull request was submitted through Github.
It can be accessed and reviewed at: https://github.com/lxc/lxd/pull/7996
This e-mail was sent by the LXC bot, direct replies will not reach the author
unless they happen to be subscribed to this list.
=== Description (from pull-request) ===
From 811a47db881650b7b7d37f6a4a42261ee2f28fba Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?St=C3=A9phane=20Graber?= <stgra...@ubuntu.com>
Date: Wed, 7 Oct 2020 22:10:22 -0400
Subject: [PATCH 1/2] lxd/events: Validate type
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Signed-off-by: Stéphane Graber <stgra...@ubuntu.com>
---
lxd/events.go | 19 +++++++++++++++----
1 file changed, 15 insertions(+), 4 deletions(-)
diff --git a/lxd/events.go b/lxd/events.go
index afdbe93633..4cf186e40f 100644
--- a/lxd/events.go
+++ b/lxd/events.go
@@ -2,6 +2,7 @@ package main
import (
"context"
+ "fmt"
"net/http"
"strings"
@@ -11,6 +12,8 @@ import (
"github.com/lxc/lxd/shared/logger"
)
+var eventTypes = []string{"logging", "operation", "lifecycle"}
+
var eventsCmd = APIEndpoint{
Path: "events",
@@ -32,9 +35,17 @@ func (r *eventsServe) String() string {
func eventsSocket(d *Daemon, r *http.Request, w http.ResponseWriter) error {
project := projectParam(r)
- typeStr := r.FormValue("type")
- if typeStr == "" {
- typeStr = "logging,operation,lifecycle"
+ types := strings.Split(r.FormValue("type"), ",")
+ if len(types) == 1 && types[0] == "" {
+ types = eventTypes
+ }
+
+ // Validate event types.
+ for _, entry := range types {
+ if !shared.StringInSlice(entry, eventTypes) {
+ response.BadRequest(fmt.Errorf("'%s' isn't a supported
event type", entry)).Render(w)
+ return nil
+ }
}
// Upgrade the connection to websocket
@@ -59,7 +70,7 @@ func eventsSocket(d *Daemon, r *http.Request, w
http.ResponseWriter) error {
// If this request is an internal one initiated by another node wanting
// to watch the events on this node, set the listener to broadcast only
// local events.
- listener, err := d.events.AddListener(project, c,
strings.Split(typeStr, ","), serverName, isClusterNotification(r))
+ listener, err := d.events.AddListener(project, c, types, serverName,
isClusterNotification(r))
if err != nil {
return err
}
From bdef9858b684a6e4a976fd1491668d209d310cd8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?St=C3=A9phane=20Graber?= <stgra...@ubuntu.com>
Date: Wed, 7 Oct 2020 22:17:32 -0400
Subject: [PATCH 2/2] lxd/events: Prevent logging access to non-admin
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Signed-off-by: Stéphane Graber <stgra...@ubuntu.com>
---
lxd/events.go | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/lxd/events.go b/lxd/events.go
index 4cf186e40f..1c58ce99db 100644
--- a/lxd/events.go
+++ b/lxd/events.go
@@ -48,6 +48,11 @@ func eventsSocket(d *Daemon, r *http.Request, w
http.ResponseWriter) error {
}
}
+ if shared.StringInSlice("logging", types) && !d.userIsAdmin(r) {
+ response.Forbidden(nil).Render(w)
+ return nil
+ }
+
// Upgrade the connection to websocket
c, err := shared.WebsocketUpgrader.Upgrade(w, r, nil)
if err != nil {
_______________________________________________
lxc-devel mailing list
lxc-devel@lists.linuxcontainers.org
http://lists.linuxcontainers.org/listinfo/lxc-devel
