Patch "psample: Require 'CAP_NET_ADMIN' when joining "packets" group" has been added to the 6.6-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    psample: Require 'CAP_NET_ADMIN' when joining "packets" group

to the 6.6-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     psample-require-cap_net_admin-when-joining-packets-g.patch
and it can be found in the queue-6.6 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit a74e4a36c1029e1f95b501caca8f2d05c67880af
Author: Ido Schimmel <idosch@xxxxxxxxxx>
Date:   Wed Dec 6 23:31:01 2023 +0200

    psample: Require 'CAP_NET_ADMIN' when joining "packets" group
    
    [ Upstream commit 44ec98ea5ea9cfecd31a5c4cc124703cb5442832 ]
    
    The "psample" generic netlink family notifies sampled packets over the
    "packets" multicast group. This is problematic since by default generic
    netlink allows non-root users to listen to these notifications.
    
    Fix by marking the group with the 'GENL_UNS_ADMIN_PERM' flag. This will
    prevent non-root users or root without the 'CAP_NET_ADMIN' capability
    (in the user namespace owning the network namespace) from joining the
    group.
    
    Tested using [1].
    
    Before:
    
     # capsh -- -c ./psample_repo
     # capsh --drop=cap_net_admin -- -c ./psample_repo
    
    After:
    
     # capsh -- -c ./psample_repo
     # capsh --drop=cap_net_admin -- -c ./psample_repo
     Failed to join "packets" multicast group
    
    [1]
     $ cat psample.c
     #include <stdio.h>
     #include <netlink/genl/ctrl.h>
     #include <netlink/genl/genl.h>
     #include <netlink/socket.h>
    
     int join_grp(struct nl_sock *sk, const char *grp_name)
     {
            int grp, err;
    
            grp = genl_ctrl_resolve_grp(sk, "psample", grp_name);
            if (grp < 0) {
                    fprintf(stderr, "Failed to resolve \"%s\" multicast group\n",
                            grp_name);
                    return grp;
            }
    
            err = nl_socket_add_memberships(sk, grp, NFNLGRP_NONE);
            if (err) {
                    fprintf(stderr, "Failed to join \"%s\" multicast group\n",
                            grp_name);
                    return err;
            }
    
            return 0;
     }
    
     int main(int argc, char **argv)
     {
            struct nl_sock *sk;
            int err;
    
            sk = nl_socket_alloc();
            if (!sk) {
                    fprintf(stderr, "Failed to allocate socket\n");
                    return -1;
            }
    
            err = genl_connect(sk);
            if (err) {
                    fprintf(stderr, "Failed to connect socket\n");
                    return err;
            }
    
            err = join_grp(sk, "config");
            if (err)
                    return err;
    
            err = join_grp(sk, "packets");
            if (err)
                    return err;
    
            return 0;
     }
     $ gcc -I/usr/include/libnl3 -lnl-3 -lnl-genl-3 -o psample_repo psample.c
    
    Fixes: 6ae0a6286171 ("net: Introduce psample, a new genetlink channel for packet sampling")
    Reported-by: "The UK's National Cyber Security Centre (NCSC)" <security@xxxxxxxxxxx>
    Signed-off-by: Ido Schimmel <idosch@xxxxxxxxxx>
    Reviewed-by: Jacob Keller <jacob.e.keller@xxxxxxxxx>
    Reviewed-by: Jiri Pirko <jiri@xxxxxxxxxx>
    Link: https://lore.kernel.org/r/20231206213102.1824398-2-idosch@xxxxxxxxxx
    Signed-off-by: Jakub Kicinski <kuba@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/psample/psample.c b/net/psample/psample.c
index 81a794e36f535..c34e902855dbe 100644
--- a/net/psample/psample.c
+++ b/net/psample/psample.c
@@ -31,7 +31,8 @@ enum psample_nl_multicast_groups {
 
 static const struct genl_multicast_group psample_nl_mcgrps[] = {
 	[PSAMPLE_NL_MCGRP_CONFIG] = { .name = PSAMPLE_NL_MCGRP_CONFIG_NAME },
-	[PSAMPLE_NL_MCGRP_SAMPLE] = { .name = PSAMPLE_NL_MCGRP_SAMPLE_NAME },
+	[PSAMPLE_NL_MCGRP_SAMPLE] = { .name = PSAMPLE_NL_MCGRP_SAMPLE_NAME,
+				      .flags = GENL_UNS_ADMIN_PERM },
 };
 
 static struct genl_family psample_nl_family __ro_after_init;




[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux