Commit 7e5c85f7f2 for qemu.org
commit 7e5c85f7f2a84dc695e70a63d0737ef481cef1a6
Author: Kostiantyn Kostiuk <kkostiuk@redhat.com>
Date: Mon Aug 10 17:28:18 2026 +0300
qga: Change effective user/group ID in guest-ssh-* commands
Before this commit, when qmp_guest_ssh_add_authorized_keys adds an
SSH key for an existing local user, the agent (running as root) decides
whether to create the user's .ssh directory with a symlink-following
directory test, and then writes and chowns the authorized_keys file.
A local unprivileged user who owns their home directory can pre-stage
their .ssh directory (or the authorized_keys file) as a symbolic link
so that, when the host or operator triggers a key add for that user,
the root agent follows the link and transfers ownership of an arbitrary
root-owned file or directory to the unprivileged user, who can then rewrite
it to obtain root.
Fixes: CVE-2026-12080
Fixes: https://gitlab.com/qemu-project/qemu/-/work_items/3929
v1: https://patchew.org/QEMU/20260709105707.91209-1-kkostiuk@redhat.com/
v2 -> v1:
Change effective user/group ID instead of checking for symlinks and
changing ownership of the file.
v2: https://patchew.org/QEMU/20260810104659.82320-1-kkostiuk@redhat.com
v3 -> v2:
Deduplicate code.
Fail daemon when can't rollback effective user/group ID.
v3: https://patchew.org/QEMU/20260810140641.161728-1-kkostiuk@redhat.com/
v4 -> v3:
Added comment about assert in rollback_effective_info
Fix memory leak in rollback_effective_info
Reported-by: Valentino Paulon <valentino.paulon88@gmail.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20260810142818.170418-1-kkostiuk@redhat.com
Signed-off-by: Kostiantyn Kostiuk <kkostiuk@redhat.com>
diff --git a/qga/commands-posix-ssh.c b/qga/commands-posix-ssh.c
index 661972e34e..aa3411049f 100644
--- a/qga/commands-posix-ssh.c
+++ b/qga/commands-posix-ssh.c
@@ -8,11 +8,34 @@
#include <glib/gstdio.h>
#include <locale.h>
#include <pwd.h>
+#include <grp.h>
#include "commands-common-ssh.h"
#include "qapi/error.h"
#include "qga-qapi-commands.h"
+typedef struct EffectiveUserInfo {
+ uid_t uid;
+ gid_t gid;
+} EffectiveUserInfo;
+
+typedef EffectiveUserInfo *PEffectiveUserInfo;
+
+static void rollback_effective_info(PEffectiveUserInfo info)
+{
+ if (info) {
+ /* There is nothing to do in case when rollback to original user/group IDs
+ * fails. In that case, the process will be terminated by the kernel
+ * and systemd should restart the daemon again.
+ */
+ assert(seteuid(info->uid) == 0);
+ assert(setegid(info->gid) == 0);
+ g_free(info);
+ }
+}
+
+G_DEFINE_AUTO_CLEANUP_FREE_FUNC(PEffectiveUserInfo, rollback_effective_info, NULL);
+
#ifdef QGA_BUILD_UNIT_TEST
static struct passwd *
test_get_passwd_entry(const gchar *user_name, GError **error)
@@ -112,6 +135,36 @@ write_authkeys(const char *path, const GStrv keys,
return true;
}
+static PEffectiveUserInfo set_privileges_to_user(const struct passwd *p, Error **errp)
+{
+ g_auto(PEffectiveUserInfo) info = g_new0(EffectiveUserInfo, 1);
+
+ info->uid = geteuid();
+ info->gid = getegid();
+
+#ifndef QGA_BUILD_UNIT_TEST
+ /* The initgroups requires CAP_SETGID. During build time unit tests, we can't do this. */
+ if (initgroups(p->pw_name, p->pw_gid) == -1) {
+ error_setg_errno(errp, errno, "failed to set group for user '%s'",
+ p->pw_name);
+ return NULL;
+ }
+#endif
+
+ if (setegid(p->pw_gid) == -1) {
+ error_setg_errno(errp, errno, "failed to set effective group ID for user '%s'",
+ p->pw_name);
+ return NULL;
+ }
+ if (seteuid(p->pw_uid) == -1) {
+ error_setg_errno(errp, errno, "failed to set effective user ID for user '%s'",
+ p->pw_name);
+ return NULL;
+ }
+
+ return g_steal_pointer(&info);
+}
+
void
qmp_guest_ssh_add_authorized_keys(const char *username, strList *keys,
bool has_reset, bool reset,
@@ -123,6 +176,7 @@ qmp_guest_ssh_add_authorized_keys(const char *username, strList *keys,
g_auto(GStrv) authkeys = NULL;
strList *k;
size_t nkeys, nauthkeys;
+ g_auto(PEffectiveUserInfo) effective_user_info = NULL;
reset = has_reset && reset;
@@ -135,6 +189,11 @@ qmp_guest_ssh_add_authorized_keys(const char *username, strList *keys,
return;
}
+ effective_user_info = set_privileges_to_user(p, errp);
+ if (effective_user_info == NULL) {
+ return;
+ }
+
ssh_path = g_build_filename(p->pw_dir, ".ssh", NULL);
authkeys_path = g_build_filename(ssh_path, "authorized_keys", NULL);
@@ -172,6 +231,7 @@ qmp_guest_ssh_remove_authorized_keys(const char *username, strList *keys,
g_auto(GStrv) authkeys = NULL;
GStrv a;
size_t nkeys = 0;
+ g_auto(PEffectiveUserInfo) effective_user_info = NULL;
if (!check_openssh_pub_keys(keys, NULL, errp)) {
return;
@@ -182,6 +242,11 @@ qmp_guest_ssh_remove_authorized_keys(const char *username, strList *keys,
return;
}
+ effective_user_info = set_privileges_to_user(p, errp);
+ if (effective_user_info == NULL) {
+ return;
+ }
+
authkeys_path = g_build_filename(p->pw_dir, ".ssh",
"authorized_keys", NULL);
if (!g_file_test(authkeys_path, G_FILE_TEST_EXISTS)) {
@@ -219,12 +284,18 @@ qmp_guest_ssh_get_authorized_keys(const char *username, Error **errp)
g_auto(GStrv) authkeys = NULL;
g_autoptr(GuestAuthorizedKeys) ret = NULL;
int i;
+ g_auto(PEffectiveUserInfo) effective_user_info = NULL;
p = get_passwd_entry(username, errp);
if (p == NULL) {
return NULL;
}
+ effective_user_info = set_privileges_to_user(p, errp);
+ if (effective_user_info == NULL) {
+ return NULL;
+ }
+
authkeys_path = g_build_filename(p->pw_dir, ".ssh",
"authorized_keys", NULL);
authkeys = read_authkeys(authkeys_path, errp);