From: HE WEI（ギカク） <skyexpoc@gmail.com>
Date: Wed, 8 Jul 2026 12:00:00 +0000 (+0000)
Subject: security: apparmor: reject rule-injection characters in smartcard database path
X-Git-Tag: v12.6.0-rc1~39
X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=212580e6b30ec0f1e00fc1813345ab9cd4cd99ba;p=thirdparty%2Flibvirt.git

security: apparmor: reject rule-injection characters in smartcard database path

The smartcard host-certificates <database> path is written straight into the
generated AppArmor profile with virBufferAsprintf(), bypassing valid_path()
which every other emitted path goes through. valid_path() rejects '"' precisely
to stop AppArmor rule injection; because the smartcard path skips it, and
virBufferEscapeString() does not escape newlines in element content, a crafted
<database> value can inject arbitrary profile rules (e.g. "/** rwmlk,").

Reject '"' and newline characters in the value before emitting it.

Signed-off-by: HE WEI（ギカク） <skyexpoc@gmail.com>
---

diff --git a/src/security/virt-aa-helper.c b/src/security/virt-aa-helper.c
index 2eae4d7f3f..a3dc2197e3 100644
--- a/src/security/virt-aa-helper.c
+++ b/src/security/virt-aa-helper.c
@@ -1339,6 +1339,11 @@ get_files(vahControl * ctl)
                 virBufferAddLit(&buf, "  \"/etc/pki/nssdb/{,*}\" rk,\n");
                 break;
             case VIR_DOMAIN_SMARTCARD_TYPE_HOST_CERTIFICATES:
+                if (strpbrk(sc_db, "\"\n\r")) {
+                    vah_error(ctl, 0,
+                              _("smartcard database path contains invalid characters"));
+                    return -1;
+                }
                 virBufferAsprintf(&buf, "  \"%s/{,*}\" rk,\n", sc_db);
                 break;
             /*