Ido Schimmel
07c8229c02
psample: Require 'CAP_NET_ADMIN' when joining "packets" group ...
[ Upstream commit 44ec98ea5ea9cfecd31a5c4cc124703cb5442832 ]
The "psample" generic netlink family notifies sampled packets over the
"packets" multicast group. This is problematic since by default generic
netlink allows non-root users to listen to these notifications.
Fix by marking the group with the 'GENL_UNS_ADMIN_PERM' flag. This will
prevent non-root users or root without the 'CAP_NET_ADMIN' capability
(in the user namespace owning the network namespace) from joining the
group.
Tested using [1].
Before:
# capsh -- -c ./psample_repo
# capsh --drop=cap_net_admin -- -c ./psample_repo
After:
# capsh -- -c ./psample_repo
# capsh --drop=cap_net_admin -- -c ./psample_repo
Failed to join "packets" multicast group
[1]
$ cat psample.c
#include <stdio.h>
#include <netlink/genl/ctrl.h>
#include <netlink/genl/genl.h>
#include <netlink/socket.h>
int join_grp(struct nl_sock *sk, const char *grp_name)
{
int grp, err;
grp = genl_ctrl_resolve_grp(sk, "psample", grp_name);
if (grp < 0) {
fprintf(stderr, "Failed to resolve \"%s\" multicast group\n",
grp_name);
return grp;
}
err = nl_socket_add_memberships(sk, grp, NFNLGRP_NONE);
if (err) {
fprintf(stderr, "Failed to join \"%s\" multicast group\n",
grp_name);
return err;
}
return 0;
}
int main(int argc, char **argv)
{
struct nl_sock *sk;
int err;
sk = nl_socket_alloc();
if (!sk) {
fprintf(stderr, "Failed to allocate socket\n");
return -1;
}
err = genl_connect(sk);
if (err) {
fprintf(stderr, "Failed to connect socket\n");
return err;
}
err = join_grp(sk, "config");
if (err)
return err;
err = join_grp(sk, "packets");
if (err)
return err;
return 0;
}
$ gcc -I/usr/include/libnl3 -lnl-3 -lnl-genl-3 -o psample_repo psample.c
Fixes: 6ae0a6286171 ("net: Introduce psample, a new genetlink channel for packet sampling")
Reported-by: "The UK's National Cyber Security Centre (NCSC)" <security@ncsc.gov.uk>
Signed-off-by: Ido Schimmel <idosch@nvidia.com>
Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
Reviewed-by: Jiri Pirko <jiri@nvidia.com>
Link: https://lore.kernel.org/r/20231206213102.1824398-2-idosch@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-12-13 18:39:11 +01:00
2023-11-28 17:07:01 +00:00
2022-12-31 13:33:02 +01:00
2023-05-24 17:32:47 +01:00
2023-06-09 10:34:16 +02:00
2022-08-22 17:55:50 -07:00
2023-08-30 16:11:08 +02:00
2023-11-28 17:06:56 +00:00
2023-03-17 08:50:32 +01:00
2023-11-28 17:07:05 +00:00
2023-03-17 08:50:24 +01:00
2023-10-19 23:08:52 +02:00
2023-10-19 23:08:56 +02:00
2023-12-13 18:39:11 +01:00
2023-08-11 12:08:17 +02:00
2023-11-20 11:52:16 +01:00
2023-09-23 11:11:01 +02:00
2023-07-19 16:22:06 +02:00
2022-08-25 10:33:21 +02:00
2023-09-19 12:28:10 +02:00
2023-11-20 11:52:15 +01:00
2022-10-07 09:29:17 +02:00
2023-12-13 18:39:11 +01:00
2023-12-13 18:39:06 +01:00
2023-03-22 13:33:50 +01:00
2023-09-19 12:28:10 +02:00
2023-08-23 17:52:32 +02:00
2023-10-10 22:00:42 +02:00
2023-11-20 11:52:15 +01:00
2023-11-28 17:06:55 +00:00
2022-12-05 09:53:08 +01:00
2023-10-19 23:08:57 +02:00
2023-02-22 12:59:53 +01:00
2023-11-28 17:07:20 +00:00
2023-11-28 17:07:18 +00:00
2023-12-13 18:39:11 +01:00
2023-09-13 09:42:24 +02:00
2023-10-10 22:00:46 +02:00
2023-09-13 09:42:35 +02:00
2023-10-25 12:03:04 +02:00
2023-05-24 17:32:45 +01:00
2023-08-23 17:52:35 +02:00
2023-08-16 18:27:26 +02:00
2023-12-13 18:39:11 +01:00
2023-04-20 12:35:09 +02:00
2023-10-19 23:08:50 +02:00
2023-10-25 12:03:06 +02:00
2023-02-22 12:59:42 +01:00
2023-05-17 11:53:35 +02:00
2023-11-08 14:10:57 +01:00
2023-10-10 22:00:44 +02:00
2023-12-03 07:32:08 +01:00
2023-11-28 17:07:11 +00:00
2023-11-28 17:07:05 +00:00
2023-11-20 11:51:52 +01:00
2023-11-28 17:07:05 +00:00
2023-11-28 17:06:56 +00:00
2023-12-11 10:41:01 +01:00
2023-02-09 11:28:13 +01:00
2023-12-13 18:39:08 +01:00
2023-10-25 12:03:12 +02:00
2023-02-09 11:28:04 +01:00
2022-08-22 14:26:30 +01:00
2022-09-20 14:23:56 -07:00
2023-08-30 16:11:00 +02:00
2023-10-19 23:08:50 +02:00
07c8229c02