netdev - Re: [PATCH v1 2/5] connector/cn_proc: Add filtering to fix some bugs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <BY5PR10MB412905AE523693D8D8A62669C4BE9@BY5PR10MB4129.namprd10.prod.outlook.com>
Date:   Tue, 14 Mar 2023 18:51:07 +0000
From:   Anjali Kulkarni <anjali.k.kulkarni@...cle.com>
To:     Christian Brauner <brauner@...nel.org>,
        Jakub Kicinski <kuba@...nel.org>
CC:     "davem@...emloft.net" <davem@...emloft.net>,
        "edumazet@...gle.com" <edumazet@...gle.com>,
        "pabeni@...hat.com" <pabeni@...hat.com>,
        "zbr@...emap.net" <zbr@...emap.net>,
        "johannes@...solutions.net" <johannes@...solutions.net>,
        "ecree.xilinx@...il.com" <ecree.xilinx@...il.com>,
        "leon@...nel.org" <leon@...nel.org>,
        "keescook@...omium.org" <keescook@...omium.org>,
        "socketcan@...tkopp.net" <socketcan@...tkopp.net>,
        "petrm@...dia.com" <petrm@...dia.com>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "netdev@...r.kernel.org" <netdev@...r.kernel.org>
Subject: Re: [PATCH v1 2/5] connector/cn_proc: Add filtering to fix some bugs



________________________________________
From: Christian Brauner <brauner@...nel.org>
Sent: Tuesday, March 14, 2023 1:38 AM
To: Jakub Kicinski
Cc: Anjali Kulkarni; davem@...emloft.net; edumazet@...gle.com; pabeni@...hat.com; zbr@...emap.net; johannes@...solutions.net; ecree.xilinx@...il.com; leon@...nel.org; keescook@...omium.org; socketcan@...tkopp.net; petrm@...dia.com; linux-kernel@...r.kernel.org; netdev@...r.kernel.org
Subject: Re: [PATCH v1 2/5] connector/cn_proc: Add filtering to fix some bugs

On Mon, Mar 13, 2023 at 05:24:41PM -0700, Jakub Kicinski wrote:
> On Fri, 10 Mar 2023 14:15:44 -0800 Anjali Kulkarni wrote:
> > diff --git a/include/linux/connector.h b/include/linux/connector.h
> > index 487350bb19c3..1336a5e7dd2f 100644
> > --- a/include/linux/connector.h
> > +++ b/include/linux/connector.h
> > @@ -96,7 +96,11 @@ void cn_del_callback(const struct cb_id *id);
> >   *
> >   * If there are no listeners for given group %-ESRCH can be returned.
> >   */
> > -int cn_netlink_send_mult(struct cn_msg *msg, u16 len, u32 portid, u32 group, gfp_t gfp_mask);
> > +int cn_netlink_send_mult(struct cn_msg *msg, u16 len, u32 portid,
> > +                    u32 group, gfp_t gfp_mask,
> > +                    int (*filter)(struct sock *dsk, struct sk_buff *skb,
> > +                                  void *data),
> > +                    void *filter_data);
>
> kdoc needs to be extended

just a thought from my side. I think giving access to unprivileged users
will require a little thought as that's potentially sensitive.

If possible I would think that the patches that don't lead to a
behavioral change should go in completely independently and then we can
discuss the non-root access change.
ANJALI> That sounds fine. I can send the non-root change as the last patch 
in the series. I can also add a change to allow the sensitive content only if
the user ID or parent ID matches etc. I know the exit status needs more
discussion..