|
 |
12b5c8b |
From 56ae5f7c9230c0aa474eef638cf9bf8ae6a79ab1 Mon Sep 17 00:00:00 2001
|
|
|
12b5c8b |
From: Kevin Cernekee <cernekee@chromium.org>
|
|
|
12b5c8b |
Date: Sun, 3 Dec 2017 12:12:45 -0800
|
|
|
12b5c8b |
Subject: [PATCH] netfilter: nfnetlink_cthelper: Add missing permission
|
|
|
12b5c8b |
checks
|
|
|
12b5c8b |
|
|
|
12b5c8b |
The capability check in nfnetlink_rcv() verifies that the caller
|
|
|
12b5c8b |
has CAP_NET_ADMIN in the namespace that "owns" the netlink socket.
|
|
|
12b5c8b |
However, nfnl_cthelper_list is shared by all net namespaces on the
|
|
|
12b5c8b |
system. An unprivileged user can create user and net namespaces
|
|
|
12b5c8b |
in which he holds CAP_NET_ADMIN to bypass the netlink_net_capable()
|
|
|
12b5c8b |
check:
|
|
|
12b5c8b |
|
|
|
12b5c8b |
$ nfct helper list
|
|
|
12b5c8b |
nfct v1.4.4: netlink error: Operation not permitted
|
|
|
12b5c8b |
$ vpnns -- nfct helper list
|
|
|
12b5c8b |
{
|
|
|
12b5c8b |
.name = ftp,
|
|
|
12b5c8b |
.queuenum = 0,
|
|
|
12b5c8b |
.l3protonum = 2,
|
|
|
12b5c8b |
.l4protonum = 6,
|
|
|
12b5c8b |
.priv_data_len = 24,
|
|
|
12b5c8b |
.status = enabled,
|
|
|
12b5c8b |
};
|
|
|
12b5c8b |
|
|
|
12b5c8b |
Add capable() checks in nfnetlink_cthelper, as this is cleaner than
|
|
|
12b5c8b |
trying to generalize the solution.
|
|
|
12b5c8b |
|
|
|
12b5c8b |
Signed-off-by: Kevin Cernekee <cernekee@chromium.org>
|
|
|
12b5c8b |
---
|
|
|
12b5c8b |
net/netfilter/nfnetlink_cthelper.c | 10 ++++++++++
|
|
|
12b5c8b |
1 file changed, 10 insertions(+)
|
|
|
12b5c8b |
|
|
|
12b5c8b |
diff --git a/net/netfilter/nfnetlink_cthelper.c b/net/netfilter/nfnetlink_cthelper.c
|
|
|
12b5c8b |
index 41628b393673..d33ce6d5ebce 100644
|
|
|
12b5c8b |
--- a/net/netfilter/nfnetlink_cthelper.c
|
|
|
12b5c8b |
+++ b/net/netfilter/nfnetlink_cthelper.c
|
|
|
12b5c8b |
@@ -17,6 +17,7 @@
|
|
|
12b5c8b |
#include <linux/types.h>
|
|
|
12b5c8b |
#include <linux/list.h>
|
|
|
12b5c8b |
#include <linux/errno.h>
|
|
|
12b5c8b |
+#include <linux/capability.h>
|
|
|
12b5c8b |
#include <net/netlink.h>
|
|
|
12b5c8b |
#include <net/sock.h>
|
|
|
12b5c8b |
|
|
|
12b5c8b |
@@ -407,6 +408,9 @@ static int nfnl_cthelper_new(struct net *net, struct sock *nfnl,
|
|
|
12b5c8b |
struct nfnl_cthelper *nlcth;
|
|
|
12b5c8b |
int ret = 0;
|
|
|
12b5c8b |
|
|
|
12b5c8b |
+ if (!capable(CAP_NET_ADMIN))
|
|
|
12b5c8b |
+ return -EPERM;
|
|
|
12b5c8b |
+
|
|
|
12b5c8b |
if (!tb[NFCTH_NAME] || !tb[NFCTH_TUPLE])
|
|
|
12b5c8b |
return -EINVAL;
|
|
|
12b5c8b |
|
|
|
12b5c8b |
@@ -611,6 +615,9 @@ static int nfnl_cthelper_get(struct net *net, struct sock *nfnl,
|
|
|
12b5c8b |
struct nfnl_cthelper *nlcth;
|
|
|
12b5c8b |
bool tuple_set = false;
|
|
|
12b5c8b |
|
|
|
12b5c8b |
+ if (!capable(CAP_NET_ADMIN))
|
|
|
12b5c8b |
+ return -EPERM;
|
|
|
12b5c8b |
+
|
|
|
12b5c8b |
if (nlh->nlmsg_flags & NLM_F_DUMP) {
|
|
|
12b5c8b |
struct netlink_dump_control c = {
|
|
|
12b5c8b |
.dump = nfnl_cthelper_dump_table,
|
|
|
12b5c8b |
@@ -678,6 +685,9 @@ static int nfnl_cthelper_del(struct net *net, struct sock *nfnl,
|
|
|
12b5c8b |
struct nfnl_cthelper *nlcth, *n;
|
|
|
12b5c8b |
int j = 0, ret;
|
|
|
12b5c8b |
|
|
|
12b5c8b |
+ if (!capable(CAP_NET_ADMIN))
|
|
|
12b5c8b |
+ return -EPERM;
|
|
|
12b5c8b |
+
|
|
|
12b5c8b |
if (tb[NFCTH_NAME])
|
|
|
12b5c8b |
helper_name = nla_data(tb[NFCTH_NAME]);
|
|
|
12b5c8b |
|
|
|
12b5c8b |
--
|
|
|
12b5c8b |
2.14.3
|
|
|
12b5c8b |
|