netdev - Re: [PATCH net-next 2/3] net-timestamp: allow reading recv cmsg on errqueue with origin tstamp

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CA+FuTSd7mMyB5srMAbewObYYbqiA+7T173Ak4E71Q=SHa0C4dw@mail.gmail.com>
Date:	Mon, 1 Dec 2014 11:59:11 -0500
From:	Willem de Bruijn <willemb@...gle.com>
To:	Andy Lutomirski <luto@...capital.net>
Cc:	Network Development <netdev@...r.kernel.org>,
	"David S. Miller" <davem@...emloft.net>,
	Richard Cochran <richardcochran@...il.com>
Subject: Re: [PATCH net-next 2/3] net-timestamp: allow reading recv cmsg on
 errqueue with origin tstamp

> Here's a thought: what if you just drop any timestamp loopback message
> if the interface doesn't belong to the sending socket's network
> namespace?
>
> Does that solve all of the problems (except perhaps those associated
> with LSM use or maybe ipsec)?

I don't have an exhaustive list of potential vulnerabilities, so it's hard to
say. The iptables example was another case where policy is leaked
that might reasonably be intended to be hidden.

We have to do it behind a sysctl, to avoid breaking legacy applications.
If so, then I would just opt for strongest interpretation and apply it for
users, regardless of namespaces. The one exception is to always allow
for callers with CAP_NET_RAW, since those can always open a packet
socket for sniffing, anyway.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html