Re: [PATCH] IB/sa: Restrict SA Netlink to admin users

["ira.weiny" <ira.weiny-ral2JQCrhuEAvxtiuMwx3w@public.gmane.org>]

On Tue, Aug 11, 2015 at 05:27:17AM -0600, Wan, Kaike wrote:
> > From: linux-rdma-owner-u79uwXL29TY76Z2rM5mHXA@public.gmane.org [mailto:linux-rdma-
> > owner-u79uwXL29TY76Z2rM5mHXA@public.gmane.org] On Behalf Of Jason Gunthorpe
> > Sent: Tuesday, August 11, 2015 1:38 AM
> > To: Weiny, Ira
> > Cc: Haggai Eran; dledford-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org; linux-rdma-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
> > Subject: Re: [PATCH] IB/sa: Restrict SA Netlink to admin users
> > 
> > On Mon, Aug 10, 2015 at 05:58:30PM -0400, ira.weiny wrote:
> > 
> > > Furthermore, the check in netlink_bind also uses the socket namespace
> > > to restrict the use of multicast.  This plus my checks should allow an
> > > admin to place the SA proxy (ibacm in our test cases) in an alternate
> > > network namespace if they so desire.  But this is independent to the
> > > namespace which may be used for data applications.
> > 
> > I think Haggai is on to something, there is certainly a problem here, that
> > netlink_bind will let a namespace subscribe is a certainly a problem for what
> > Haggai is working on.
> > 
> > For now, I think, only root (or CAP_ whatever) in the init namespace should
> > have access to this feature. Not sure how to check that.
> 
> netlink_capable(skb, CAP_NET_ADMIN) will do the trick.
 
For these calls yes.  For the bind call I think we need to investigate more.

Ira

--
To unsubscribe from this list: send the line "unsubscribe linux-rdma" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html