make sure console/vnc socket folder is read-only

Signed-off-by: Arik Hadas <[email protected]>
xiaoruiguo · Aug 8, 2019 · 944e019 · 944e019
1 parent 5bdb2ad
commit 944e019
Showing 1 changed file with 15 additions and 5 deletions.
diff --git a/pkg/virt-handler/rest/console.go b/pkg/virt-handler/rest/console.go
@@ -24,6 +24,7 @@ import (
 	"io"
 	"net"
 	"net/http"
+	"os"
 	"path"
 	"strconv"
 	"sync"
@@ -61,13 +62,13 @@ func NewConsoleHandler(podIsolationDetector isolation.PodIsolationDetector, vmiI
 func (t *ConsoleHandler) VNCHandler(request *restful.Request, response *restful.Response) {
 	vmi, code, err := t.getVMI(request)
 	if err != nil {
-		log.Log.Object(vmi).Reason(err).Error("Failed retrieve VMI")
+		log.Log.Object(vmi).Reason(err).Error("Failed to retrieve VMI")
 		response.WriteError(code, err)
 		return
 	}
 	unixSocketPath, err := t.getUnixSocketPath(vmi, "virt-vnc")
 	if err != nil {
-		log.Log.Object(vmi).Reason(err).Error("Failed unix socket for VNC console")
+		log.Log.Object(vmi).Reason(err).Error("Failed finding unix socket for VNC console")
 		response.WriteError(http.StatusBadRequest, err)
 		return
 	}
@@ -82,13 +83,13 @@ func (t *ConsoleHandler) VNCHandler(request *restful.Request, response *restful.
 func (t *ConsoleHandler) SerialHandler(request *restful.Request, response *restful.Response) {
 	vmi, code, err := t.getVMI(request)
 	if err != nil {
-		log.Log.Object(vmi).Reason(err).Error("Failed retrieve VMI")
+		log.Log.Object(vmi).Reason(err).Error("Failed to retrieve VMI")
 		response.WriteError(code, err)
 		return
 	}
 	unixSocketPath, err := t.getUnixSocketPath(vmi, "virt-serial0")
 	if err != nil {
-		log.Log.Object(vmi).Reason(err).Error("Failed unix socket for serial console")
+		log.Log.Object(vmi).Reason(err).Error("Failed finding unix socket for serial console")
 		response.WriteError(http.StatusBadRequest, err)
 		return
 	}
@@ -140,7 +141,16 @@ func (t *ConsoleHandler) getUnixSocketPath(vmi *v1.VirtualMachineInstance, socke
 	if err != nil {
 		return "", err
 	}
-	return path.Join("proc", strconv.Itoa(result.Pid()), "root", "var", "run", "kubevirt-private", string(vmi.GetUID()), socketName), nil
+	socketDir := path.Join("proc", strconv.Itoa(result.Pid()), "root", "var", "run", "kubevirt-private", string(vmi.GetUID()))
+	socketPath := path.Join(socketDir, socketName)
+	if _, err = os.Stat(socketPath); os.IsNotExist(err) {
+		return "", err
+	}
+	// See https://github.com/kubevirt/kubevirt/pull/2171
+	if err = os.Chmod(socketDir, 0444); err != nil {
+		return "", err
+	}
+	return socketPath, nil
 }
 
 type cleanupOnError func()