netdev - Re: [PATCH] iptables: Per-net ns lock

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20180420230620.GA23540@outlook.office365.com>
Date:   Fri, 20 Apr 2018 16:06:21 -0700
From:   Andrei Vagin <avagin@...tuozzo.com>
To:     Kirill Tkhai <ktkhai@...tuozzo.com>
Cc:     fw@...len.de, netdev@...r.kernel.org, pablo@...filter.org,
        rstoyanov1@...il.com, ptikhomirov@...tuozzo.com
Subject: Re: [PATCH] iptables: Per-net ns lock

On Fri, Apr 20, 2018 at 04:42:47PM +0300, Kirill Tkhai wrote:
> Containers want to restore their own net ns,
> while they may have no their own mnt ns.
> This case they share host's /run/xtables.lock
> file, but they may not have permission to open
> it.
> 
> Patch makes /run/xtables.lock to be per-namespace,
> i.e., to refer to the caller task's net ns.
>
> Signed-off-by: Kirill Tkhai <ktkhai@...tuozzo.com>
> ---
>  iptables/xshared.c |    7 ++++++-
>  1 file changed, 6 insertions(+), 1 deletion(-)
> 
> diff --git a/iptables/xshared.c b/iptables/xshared.c
> index 06db72d4..b6dbe4e7 100644
> --- a/iptables/xshared.c
> +++ b/iptables/xshared.c
> @@ -254,7 +254,12 @@ static int xtables_lock(int wait, struct timeval *wait_interval)
>  	time_left.tv_sec = wait;
>  	time_left.tv_usec = 0;
>  
> -	fd = open(XT_LOCK_NAME, O_CREAT, 0600);
> +	if (symlink("/proc/self/ns/net", XT_LOCK_NAME) != 0 &&

Any user can open this file and take the lock. Before this patch, the
lock file could be opened only by the root user. It means that any user
will be able to block all iptables operations. Do I miss something?

[root@...4 ~]# ln -s /proc/self/ns/net /run/xtables.lock2
[root@...4 ~]# ls -l /run/xtables.lock2
lrwxrwxrwx 1 root root 17 Apr 21 01:52 /run/xtables.lock2 ->
/proc/self/ns/net
[root@...4 ~]# ls -l /proc/self/ns/net 
lrwxrwxrwx 1 root root 0 Apr 21 01:52 /proc/self/ns/net ->
net:[4026531993]

Thanks,
Andrei

> +	    errno != EEXIST) {
> +		fprintf(stderr, "Fatal: can't create lock file\n");

		fprintf(stderr, "Fatal: can't create lock file %s: %s\n",
			XT_LOCK_NAME, strerror(errno));

> +		return XT_LOCK_FAILED;
> +	}
> +	fd = open(XT_LOCK_NAME, O_RDONLY);
>  	if (fd < 0) {
>  		fprintf(stderr, "Fatal: can't open lock file %s: %s\n",
>  			XT_LOCK_NAME, strerror(errno));
>