netdev - bpf program loader doesn't honor CAP_NET

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Sun, 26 May 2019 21:14:11 +0200
From:   Andreas Steinmetz <ast@...dv.de>
To:     netdev@...r.kernel.org
Subject: bpf program loader doesn't honor CAP_NET_ADMIN

Quite simple "program":

start as root
configure rlimit_memlock
drop root but keep CAP_NET_ADMIN and CAP_NET_RAW
create network interface
configure network interface
create CLSACT qdisc for interface
reconfigure eBPF program for interface
call bpf(BPF_PROGLOAD, ...) with program type BPF_PROG_TYPE_SCHED_CLS

Result: EPERM

That bpf() does honor CAP_SYS_ADMIN doesn't help as this is too broad
for network related actions and may pose a security problem.

Privileged network related bpf program load should honour CAP_NET_ADMIN
in addition to CAP_SYS_ADMIN.