Repository navigation
Conversation
Lets a Server refuse to open anything but regular files. Opening a FIFO would otherwise block the request handler forever and opening a device node reaches the device, which matters when the server runs with more privileges than its clients. Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
|
We've been looking into some issues on our end where a client could cause our server-side SFTP server to get stuck by making it access FIFOs, though other non-regular file types may suffer from the same issue. |
|
First: why are you not using openssh’s Our implementation is obviously less well tested as the official sftp-server, and our Even more specifically, the standard which we support mentions at times that if a file is not a regular file, that numerous assumptions can fail. Without a better understanding your use case, and why the original P.S.: You’re basically asking for unexpected bugs in our implementation leading to security concerns. |
|
Incus is a container and virtual-machine manager. We use pkg/sftp as both a client and server to provide an SFTP API to the filesystems inside of our containers and virtual machines. For containers, it's run as a sub-process inside of the user and mount namespace of the container. For virtual-machines, it's run in-process within our existing VM guest agent. Because it always runs with full access to the filesystem it's running in and provides that full access to the user over the API, we don't really have much security risk around it, we're not using it to do any kind of privilege separation or anything. The issue we have is that it needs to die when we tell it to and a user being able to open a non-regular file (FIFO in this case, char/block devices could have a similar issue) may allow the user to open something which will be forever stuck in I/O wait. The intent of this PR is to offer an option preventing opening any such files. We don't care if the user can create/delete them, that's all fine, we just don't want them to open them and get an FD that will hang during read/write. |
|
I just noticed I forgot to mention why we're not using sftp-server, it's simple. We have no control on the filesystem that's running in the container or VM, so we can't assume that sftp-server is present on the filesystem in the first place. As our agent also handles interactive shell sessions, most of our users very specifically do not have SSH installed in there. |
Lets a Server refuse to open anything but regular files. Opening a FIFO would otherwise block the request handler forever and opening a device node reaches the device, which matters when the server runs with more privileges than its clients.