Qubes/core-admin
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

qrexec_daemon limits the number of its children

Browse Source 
So that evil VM cannot just send flood of exec qfile-daemon requests,
and DoS dom0.
This commit is contained in:
Rafal Wojtczuk 2011-03-16 14:21:45 +01:00
parent 777eaa2168
commit 27cfd6111a
1 changed files with 46 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

47
qrexec/qrexec_daemon.c
View File

@ -27,6 +27,7 @@
#include <errno.h> #include <errno.h>
#include <fcntl.h> #include <fcntl.h>
#include <sys/stat.h> #include <sys/stat.h>
#include <sys/wait.h>
#include <ioall.h> #include <ioall.h>
#include "qrexec.h" #include "qrexec.h"
#include "buffer.h" #include "buffer.h"
@ -55,6 +56,8 @@ void handle_usr1(int x)
exit(0); exit(0);
} }
void sigchld_handler(int x);
char *remote_domain_name; char *remote_domain_name;
void init(int xid) void init(int xid)
@ -97,7 +100,7 @@ void init(int xid)
setuid(getuid()); setuid(getuid());
server_fd = get_server_socket(xid, remote_domain_name); server_fd = get_server_socket(xid, remote_domain_name);
signal(SIGPIPE, SIG_IGN); signal(SIGPIPE, SIG_IGN);
signal(SIGCHLD, SIG_IGN); signal(SIGCHLD, sigchld_handler);
signal(SIGUSR1, SIG_DFL); signal(SIGUSR1, SIG_DFL);
kill(getppid(), SIGUSR1); kill(getppid(), SIGUSR1);
} }
@ -252,10 +255,48 @@ void pass_to_client(int clid, struct client_header *hdr)
} }
} }
int children_count;
int child_exited;
void sigchld_handler(int x)
{
child_exited = 1;
signal(SIGCHLD, sigchld_handler);
}
void reap_children()
{
int status;
while (waitpid(-1, &status, WNOHANG) > 0)
children_count--;
child_exited = 0;
}
void wait_for_child()
{
int status;
waitpid(-1, &status, 0);
children_count--;
}
#define MAX_CHILDREN 10
void check_children_count()
{
if (children_count > MAX_CHILDREN) {
fprintf(stderr,
"max number of children reached, waiting for child exit...\n");
wait_for_child();
fprintf(stderr, "now children_count=%d, continuing.\n",
children_count);
}
}
void handle_trigger_exec(int req) void handle_trigger_exec(int req)
{ {
char *rcmd = NULL, *lcmd = NULL; char *rcmd = NULL, *lcmd = NULL;
int i; int i;
check_children_count();
switch (req) { switch (req) {
case QREXEC_EXECUTE_FILE_COPY: case QREXEC_EXECUTE_FILE_COPY:
rcmd = "directly:user:/usr/lib/qubes/qfile-agent"; rcmd = "directly:user:/usr/lib/qubes/qfile-agent";
@ -276,6 +317,7 @@ void handle_trigger_exec(int req)
case 0: case 0:
break; break;
default: default:
children_count++;
return; return;
} }
for (i = 3; i < 256; i++) for (i = 3; i < 256; i++)
@ -405,5 +447,8 @@ int main(int argc, char **argv)
if (clients[i].state != CLIENT_INVALID if (clients[i].state != CLIENT_INVALID
&& FD_ISSET(i, &wrset)) && FD_ISSET(i, &wrset))
flush_client_data_daemon(i); flush_client_data_daemon(i);
if (child_exited)
reap_children();
} }
} }