Re: [PATCH V2] IB/sa: Restrict SA Netlink to admin users

[Doug Ledford <dledford-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>]

[-- Attachment #1: Type: text/plain, Size: 1288 bytes --]

On 08/12/2015 03:43 PM, ira.weiny wrote:
> On Mon, Aug 10, 2015 at 10:46:55PM -0400, ira.weiny-ral2JQCrhuEAvxtiuMwx3w@public.gmane.org wrote:
>> From: Ira Weiny <ira.weiny-ral2JQCrhuEAvxtiuMwx3w@public.gmane.org>
>>
>> The recently added SA Netlink service requires admin privileges to receive
>> kernel requests.  This is only partially sufficient to protect the kernel from
>> malicious users.  This patch fixes two issues.
>>
>> 	1) Path responses from user space could be spoofed if the sequence
>> 	   number was properly guessed.
>> 	2) The set timeout request message could be issued by any user.
>>
>> Ignore these messages if not submitted by an admin user.
>>
>> Fixes: 6619209af36c ("IB/sa: Route SA pathrecord query through netlink")
>> Signed-off-by: Ira Weiny <ira.weiny-ral2JQCrhuEAvxtiuMwx3w@public.gmane.org>
>>
>> ---
>> Changes from V1:
>> 	Use netlink_net_capable rather than ns_capable
> 
> Doug,
> 
> As per the thread with the V1 patch we are looking to merge this into a v9 of
> Kaikes series once we do some more testing with the netlink_bind and
> namespaces.
> 
> So you can safely ignore both v1 and this patch.

Ok.


-- 
Doug Ledford <dledford-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
              GPG KeyID: 0E572FDD



[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 884 bytes --]