[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAM0EoMmPEQ5nETLt8OkADQR+ACgHCOShp6gEA1DK+jR7mK-gNA@mail.gmail.com>
Date: Thu, 7 Dec 2023 05:16:30 -0500
From: Jamal Hadi Salim <jhs@...atatu.com>
To: Ido Schimmel <idosch@...dia.com>
Cc: netdev@...r.kernel.org, davem@...emloft.net, kuba@...nel.org,
pabeni@...hat.com, edumazet@...gle.com, nhorman@...driver.com,
yotam.gi@...il.com, jiri@...nulli.us, johannes@...solutions.net,
jacob.e.keller@...el.com, horms@...nel.org, andriy.shevchenko@...ux.intel.com
Subject: Re: [PATCH net 1/2] psample: Require 'CAP_NET_ADMIN' when joining
"packets" group
On Wed, Dec 6, 2023 at 4:33 PM Ido Schimmel <idosch@...dia.com> wrote:
>
> The "psample" generic netlink family notifies sampled packets over the
> "packets" multicast group. This is problematic since by default generic
> netlink allows non-root users to listen to these notifications.
>
> Fix by marking the group with the 'GENL_UNS_ADMIN_PERM' flag. This will
> prevent non-root users or root without the 'CAP_NET_ADMIN' capability
> (in the user namespace owning the network namespace) from joining the
> group.
>
Out of curiosity, shouldnt reading/getting also be disallowed then?
Traditionally both listening and reading has been allowed without root
for most netlink endpoints...
IOW, if i cant listen but am able to dump, isnt whatever "security
hole" still in play even after this change?
cheers,
jamal
> Tested using [1].
>
> Before:
>
> # capsh -- -c ./psample_repo
> # capsh --drop=cap_net_admin -- -c ./psample_repo
>
> After:
>
> # capsh -- -c ./psample_repo
> # capsh --drop=cap_net_admin -- -c ./psample_repo
> Failed to join "packets" multicast group
>
> [1]
> $ cat psample.c
> #include <stdio.h>
> #include <netlink/genl/ctrl.h>
> #include <netlink/genl/genl.h>
> #include <netlink/socket.h>
>
> int join_grp(struct nl_sock *sk, const char *grp_name)
> {
> int grp, err;
>
> grp = genl_ctrl_resolve_grp(sk, "psample", grp_name);
> if (grp < 0) {
> fprintf(stderr, "Failed to resolve \"%s\" multicast group\n",
> grp_name);
> return grp;
> }
>
> err = nl_socket_add_memberships(sk, grp, NFNLGRP_NONE);
> if (err) {
> fprintf(stderr, "Failed to join \"%s\" multicast group\n",
> grp_name);
> return err;
> }
>
> return 0;
> }
>
> int main(int argc, char **argv)
> {
> struct nl_sock *sk;
> int err;
>
> sk = nl_socket_alloc();
> if (!sk) {
> fprintf(stderr, "Failed to allocate socket\n");
> return -1;
> }
>
> err = genl_connect(sk);
> if (err) {
> fprintf(stderr, "Failed to connect socket\n");
> return err;
> }
>
> err = join_grp(sk, "config");
> if (err)
> return err;
>
> err = join_grp(sk, "packets");
> if (err)
> return err;
>
> return 0;
> }
> $ gcc -I/usr/include/libnl3 -lnl-3 -lnl-genl-3 -o psample_repo psample.c
>
> Fixes: 6ae0a6286171 ("net: Introduce psample, a new genetlink channel for packet sampling")
> Reported-by: "The UK's National Cyber Security Centre (NCSC)" <security@...c.gov.uk>
> Signed-off-by: Ido Schimmel <idosch@...dia.com>
> ---
> net/psample/psample.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/net/psample/psample.c b/net/psample/psample.c
> index 81a794e36f53..c34e902855db 100644
> --- a/net/psample/psample.c
> +++ b/net/psample/psample.c
> @@ -31,7 +31,8 @@ enum psample_nl_multicast_groups {
>
> static const struct genl_multicast_group psample_nl_mcgrps[] = {
> [PSAMPLE_NL_MCGRP_CONFIG] = { .name = PSAMPLE_NL_MCGRP_CONFIG_NAME },
> - [PSAMPLE_NL_MCGRP_SAMPLE] = { .name = PSAMPLE_NL_MCGRP_SAMPLE_NAME },
> + [PSAMPLE_NL_MCGRP_SAMPLE] = { .name = PSAMPLE_NL_MCGRP_SAMPLE_NAME,
> + .flags = GENL_UNS_ADMIN_PERM },
> };
>
> static struct genl_family psample_nl_family __ro_after_init;
> --
> 2.40.1
>
Powered by blists - more mailing lists