netdev - CAP_NET_ADMIN check in tc_ctl_action() makes it not allowed for user ns root

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 1 Jun 2021 16:17:29 +0800
From:   tianyu zhou <tyjoe.linux@...il.com>
To:     Jamal Hadi Salim <jhs@...atatu.com>,
        Cong Wang <xiyou.wangcong@...il.com>,
        Jiri Pirko <jiri@...nulli.us>
Cc:     "David S. Miller" <davem@...emloft.net>,
        Jakub Kicinski <kuba@...nel.org>, netdev@...r.kernel.org
Subject: CAP_NET_ADMIN check in tc_ctl_action() makes it not allowed for user
 ns root

Hi, from commit "net: Allow tc changes in user
namespaces"(SHA:4e8bbb819d1594a01f91b1de83321f68d3e6e245) I learned
that "root in a user namespace may set tc rules inside that
namespace".

I do see the CAP_NET_ADMIN check in tc_* functions has changed from
capable() to ns_capable() (which is now in term of
netlink_ns_capable())

However, in function tc_ctl_action(), the check for CAP_NET_ADMIN is
still netlink_capable which does not allow user ns root to pass this
check.

static int tc_ctl_action(struct sk_buff *skb, struct nlmsghdr *n,
             struct netlink_ext_ack *extack)
{
    ...
    if ((n->nlmsg_type != RTM_GETACTION) &&
        !netlink_capable(skb, CAP_NET_ADMIN))
        return -EPERM;
    ...
}

So is this a check missing changing for user ns?

Thanks!

Best regards,
Tianyu