Ido Schimmel
5299bca8c6
psample: Require 'CAP_NET_ADMIN' when joining "packets" group ...
[ Upstream commit 44ec98ea5ea9cfecd31a5c4cc124703cb5442832 ]
The "psample" generic netlink family notifies sampled packets over the
"packets" multicast group. This is problematic since by default generic
netlink allows non-root users to listen to these notifications.
Fix by marking the group with the 'GENL_UNS_ADMIN_PERM' flag. This will
prevent non-root users or root without the 'CAP_NET_ADMIN' capability
(in the user namespace owning the network namespace) from joining the
group.
Tested using [1].
Before:
# capsh -- -c ./psample_repo
# capsh --drop=cap_net_admin -- -c ./psample_repo
After:
# capsh -- -c ./psample_repo
# capsh --drop=cap_net_admin -- -c ./psample_repo
Failed to join "packets" multicast group
[1]
$ cat psample.c
#include <stdio.h>
#include <netlink/genl/ctrl.h>
#include <netlink/genl/genl.h>
#include <netlink/socket.h>
int join_grp(struct nl_sock *sk, const char *grp_name)
{
int grp, err;
grp = genl_ctrl_resolve_grp(sk, "psample", grp_name);
if (grp < 0) {
fprintf(stderr, "Failed to resolve \"%s\" multicast group\n",
grp_name);
return grp;
}
err = nl_socket_add_memberships(sk, grp, NFNLGRP_NONE);
if (err) {
fprintf(stderr, "Failed to join \"%s\" multicast group\n",
grp_name);
return err;
}
return 0;
}
int main(int argc, char **argv)
{
struct nl_sock *sk;
int err;
sk = nl_socket_alloc();
if (!sk) {
fprintf(stderr, "Failed to allocate socket\n");
return -1;
}
err = genl_connect(sk);
if (err) {
fprintf(stderr, "Failed to connect socket\n");
return err;
}
err = join_grp(sk, "config");
if (err)
return err;
err = join_grp(sk, "packets");
if (err)
return err;
return 0;
}
$ gcc -I/usr/include/libnl3 -lnl-3 -lnl-genl-3 -o psample_repo psample.c
Fixes: 6ae0a6286171 ("net: Introduce psample, a new genetlink channel for packet sampling")
Reported-by: "The UK's National Cyber Security Centre (NCSC)" <security@ncsc.gov.uk>
Signed-off-by: Ido Schimmel <idosch@nvidia.com>
Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
Reviewed-by: Jiri Pirko <jiri@nvidia.com>
Link: https://lore.kernel.org/r/20231206213102.1824398-2-idosch@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-12-13 18:36:37 +01:00
2023-11-28 16:56:19 +00:00
2022-12-31 13:14:42 +01:00
2023-12-08 08:48:02 +01:00
2023-06-09 10:32:26 +02:00
2022-06-22 14:22:01 +02:00
2023-08-30 16:18:18 +02:00
2023-11-28 16:56:16 +00:00
2022-12-31 13:14:11 +01:00
2023-11-28 16:56:24 +00:00
2023-03-17 08:48:54 +01:00
2023-11-08 17:26:49 +01:00
2023-10-19 23:05:36 +02:00
2023-12-13 18:36:37 +01:00
2023-08-11 15:13:53 +02:00
2023-11-28 16:56:22 +00:00
2023-07-23 13:47:30 +02:00
2023-05-17 11:50:18 +02:00
2023-11-20 11:08:28 +01:00
2022-11-03 23:59:14 +09:00
2023-12-13 18:36:37 +01:00
2023-12-13 18:36:34 +01:00
2023-03-22 13:31:28 +01:00
2023-09-19 12:23:04 +02:00
2023-08-26 14:23:32 +02:00
2023-10-10 21:59:07 +02:00
2022-04-27 14:38:53 +02:00
2023-11-20 11:08:28 +01:00
2023-11-28 16:56:15 +00:00
2022-12-14 11:37:25 +01:00
2023-10-25 11:58:59 +02:00
2023-02-22 12:57:09 +01:00
2023-11-28 16:56:22 +00:00
2023-11-28 16:56:33 +00:00
2023-12-13 18:36:37 +01:00
2023-09-19 12:22:29 +02:00
2023-07-23 13:46:56 +02:00
2023-09-19 12:22:35 +02:00
2023-10-25 11:58:55 +02:00
2023-05-24 17:36:51 +01:00
2023-02-22 12:57:09 +01:00
2023-08-16 18:22:01 +02:00
2022-01-11 15:35:16 +01:00
2023-12-13 18:36:37 +01:00
2023-04-20 12:13:53 +02:00
2023-10-19 23:05:33 +02:00
2023-10-25 11:58:57 +02:00
2023-02-22 12:57:02 +01:00
2023-05-17 11:50:17 +02:00
2023-11-08 17:26:45 +01:00
2023-10-10 21:59:08 +02:00
2023-12-03 07:31:22 +01:00
2023-11-28 16:56:29 +00:00
2023-11-28 16:56:23 +00:00
2023-09-19 12:23:04 +02:00
2023-11-28 16:56:24 +00:00
2023-11-08 17:26:37 +01:00
2023-10-25 11:59:00 +02:00
2023-02-09 11:26:40 +01:00
2023-09-19 12:22:58 +02:00
2023-10-25 11:58:56 +02:00
2023-06-21 15:59:15 +02:00
2023-06-21 15:59:15 +02:00
2023-10-19 23:05:33 +02:00
5299bca8c6