[Virtio-fs] [virtiofsd-rs] MR opened: Prevent opening of special files (CVE-2020-35517)

[virtiofs-bot at sinrega.org]

Implement the mitigation for CVE-2020-35517 by applying the following
changes:

- In InodeData::open_file(), return EBADF if the file we're opening
is not a regular file nor a directory.

- In PassthroughFs::create(), always pass libc::O_EXCL to
libc::openat(), to ensure we're not being used to bypass the file mode
restrictions at InodeData::open_file(). If the syscall fails with
EEXIST, and libc::O_EXCL wasn't among the flags passed by the client,
open the existing file using InodeData::open_file().

This is based on the work done by Stefan Hajnoczi and others for
QEMU/virtiofsd:

https://lists.gnu.org/archive/html/qemu-devel/2021-02/msg01582.html

This is an extract from the cover page of his patch series:

---
A well-behaved FUSE client does not attempt to open special files with
FUSE_OPEN because they are handled on the client side (e.g. device nodes
are handled by client-side device drivers).

The check to prevent virtiofsd from opening special files is missing in
a few cases, most notably FUSE_OPEN. A malicious client can cause
virtiofsd to open a device node, potentially allowing the guest to
escape. This can be exploited by a modified guest device driver. It is
not exploitable from guest userspace since the guest kernel will handle
special files inside the guest instead of sending FUSE requests.

This patch series fixes this issue by introducing the lo_inode_open() function
to check the file type before opening it. This is a short-term solution because
it does not prevent a compromised virtiofsd process from opening device nodes
on the host.

This issue was diagnosed on public IRC and is therefore already known
and not embargoed.
---

Fixes: CVE-2020-35517
Fixes: #9
Reported-by: Alex Xu <alex at alxu.ca>
Signed-off-by: Sergio Lopez <slp at redhat.com>
---
https://gitlab.com/virtio-fs/virtiofsd-rs/-/merge_requests/38