netdev - Re: [PATCH 5/5] net: Use netlink_ns_capable to verify the permisions of netlink messages

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <CALCETrWP_u+9Aw1Hf-7JWECP5mX55rUAp4bKRJf16jjo=0-+0w@mail.gmail.com>
Date:	Thu, 8 May 2014 14:49:11 -0700
From:	Andy Lutomirski <luto@...capital.net>
To:	Linus Torvalds <torvalds@...ux-foundation.org>
Cc:	Stephen Hemminger <stephen@...workplumber.org>,
	"security@...nel.org" <security@...nel.org>,
	Vivek Goyal <vgoyal@...hat.com>,
	"Serge E. Hallyn" <serge@...lyn.com>,
	Simo Sorce <ssorce@...hat.com>,
	"Eric W. Biederman" <ebiederm@...ssion.com>,
	Network Development <netdev@...r.kernel.org>,
	"Jorge Boncompte [DTI2]" <jorge@...2.net>,
	David Miller <davem@...emloft.net>
Subject: Re: [PATCH 5/5] net: Use netlink_ns_capable to verify the permisions
 of netlink messages

On Thu, May 8, 2014 at 2:41 PM, Linus Torvalds
<torvalds@...ux-foundation.org> wrote:
>
> On May 8, 2014 2:29 PM, "Stephen Hemminger" <stephen@...workplumber.org>
> wrote:
>>
>> Ideally it should be able to not have to raise/lower on each send/recvmsg
>> call.
>
> Well, that's actually what the *new* semantics are: only raise them for the
> socket open, then the reads and writes well be done with the elevated
> privileges.
>
> Sadly, the thing apparently does exactly the reverse, which is wasteful
> _and_ now breaks with the fixed semantics.
>
> Annoying. We may have to revert the changes because of the regression, even
> though it sounds like the new semantics would actually be preferred for the
> very application that regresses...
>

The current code checks capabilities on socket *and* send{msg,to,}.  I
think is this because we were worried that dropping privilege might
stop working.

TBH, I'm starting to think that the real solution is to add a new syscall:

sys_net_ctl(int nl_proto, const void *intput, size_t inlen, void
*output, size_t outlen)

This sends a netlink message to the kernel and returns the response,
if any.  We could eventually deprecate the use of netlink sockets for
anything other than receiving notifications from the kernel and
dealing with netfilter logs, queues, and such.

Heck, the kernel tinification people might love this.

--Andy
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html