Re: [libvirt] [PATCH] security: provide supplemental groups even when parsing label (CVE-2013-4291)

2013-08-29 Thread Eric Blake
On 08/29/2013 08:53 AM, Daniel P. Berrange wrote: > On Thu, Aug 29, 2013 at 08:47:11AM -0600, Eric Blake wrote: >> Commit 29fe5d7 (released in 1.1.1) introduced a latent problem >> for any caller of virSecurityManagerSetProcessLabel and where >> the domain already had a uid:gid label to be parsed.

Re: [libvirt] [PATCH] security: provide supplemental groups even when parsing label (CVE-2013-4291)

2013-08-29 Thread Daniel P. Berrange
On Thu, Aug 29, 2013 at 08:47:11AM -0600, Eric Blake wrote: > Commit 29fe5d7 (released in 1.1.1) introduced a latent problem > for any caller of virSecurityManagerSetProcessLabel and where > the domain already had a uid:gid label to be parsed. Such a > setup would collect the list of supplementary

[libvirt] [PATCH] security: provide supplemental groups even when parsing label (CVE-2013-4291)

2013-08-29 Thread Eric Blake
Commit 29fe5d7 (released in 1.1.1) introduced a latent problem for any caller of virSecurityManagerSetProcessLabel and where the domain already had a uid:gid label to be parsed. Such a setup would collect the list of supplementary groups during virSecurityManagerPreFork, but then ignores that info