lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Wed, 30 Sep 2009 15:20:35 +0200 From: Lars Ellenberg <lars.ellenberg@...bit.com> To: Evgeniy Polyakov <zbr@...emap.net> Cc: Philipp Reisner <philipp.reisner@...bit.com>, linux-kernel@...r.kernel.org, netdev@...r.kernel.org, Andrew Morton <akpm@...ux-foundation.com> Subject: Re: [PATCH] connector: Allow permission checking in the receiver callbacks On Wed, Sep 30, 2009 at 03:20:57PM +0400, Evgeniy Polyakov wrote: > Hi Philipp. > > On Tue, Sep 29, 2009 at 04:48:07PM +0200, Philipp Reisner (philipp.reisner@...bit.com) wrote: > > Various users of the connector should actually check if the > > sender's capabilities of a netlink/connector packet are > > actually sufficient for the operation they trigger. Up to > > now the connector framework did not allow the kernel side > > receiver to do so. > > > > This patch set does the groundwork. > > > > Philipp Reisner (4): > > connector: Keep the skb in cn_callback_data > > connector: Provide the sender's credentials to the callback > > connector/dm: Fixed a compilation warning > > connector: Removed the destruct_data callback since it is always > > kfree_skb() > > Patches look good to me. > Andrew please apply to the appropriate tree. I do not know whether it is > acceptible now, since it is not a bugfix, but merely a simple cleanup. > Feel free to add my signed off or ack, thank you. Thanks. Actually it is the basis for follow-up security fixes. Without this, unprivileged user space is able to send arbitrary connector requests to kernel subsystems, which have no way to verify the privileges of the sender anymore, because that information, even though available at the netlink layer, has been dropped by the connector. Once this is applied, the various in-kernel receiving connector callbacks can (and need to) add cap_raised(nsb->eff_cap, cap) where appropriate. For example, you don't want some guest user to be able to trigger a dst_del_node callback by sending a crafted netlink message, right? So it _is_ a (design-) bug fix. Or am I missing something? Lars -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists