security: apparmor: reject rule-injection characters in smartcard database path

The smartcard host-certificates <database> path is written straight into the
generated AppArmor profile with virBufferAsprintf(), bypassing valid_path()
which every other emitted path goes through. valid_path() rejects '"' precisely
to stop AppArmor rule injection; because the smartcard path skips it, and
virBufferEscapeString() does not escape newlines in element content, a crafted
<database> value can inject arbitrary profile rules (e.g. "/** rwmlk,").

Reject '"' and newline characters in the value before emitting it.

Signed-off-by: HE WEI（ギカク） <skyexpoc@gmail.com>

diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c
index 2eae4d7f3f608ecb8f0b5f3c087e80ae63957d5b..a3dc2197e390441ef43009c08c4777b116f65679 100644 (file)
--- a/src/security/virt-aa-helper.c
+++ b/src/security/virt-aa-helper.c
@@ -1339,6 +1339,11 @@ get_files(vahControl * ctl)
                 virBufferAddLit(&buf, "  \"/etc/pki/nssdb/{,*}\" rk,\n");
                 break;
             case VIR_DOMAIN_SMARTCARD_TYPE_HOST_CERTIFICATES:
+                if (strpbrk(sc_db, "\"\n\r")) {
+                    vah_error(ctl, 0,
+                              _("smartcard database path contains invalid characters"));
+                    return -1;
+                }
                 virBufferAsprintf(&buf, "  \"%s/{,*}\" rk,\n", sc_db);
                 break;
             /*