* [PATCH next v1] bonding: Display LACP info only to CAP_NET_ADMIN capable user
@ 2015-06-12 19:24 Mahesh Bandewar
2015-06-15 14:08 ` Andy Gospodarek
0 siblings, 1 reply; 2+ messages in thread
From: Mahesh Bandewar @ 2015-06-12 19:24 UTC (permalink / raw)
To: Jay Vosburgh, Andy Gospodarek, Veaceslav Falico,
Nikolay Aleksandrov, David Miller
Cc: Mahesh Bandewar, netdev, Eric Dumazet, Maciej Zenczykowski
Actor and Partner details can be accessed via proc-fs and sys-fs
entries. These interfaces are world readable at this moment. The
earlier patch-series made the LACP communication secure to avoid
nuisance attack from within the same L2 domain but it did not
prevent "someone unprivileged" looking at that information on host
and perform the same act.
This patch essentially avoids spitting those entries if the user
in question does not have enough privileges.
Signed-off-by: Mahesh Bandewar <maheshb@google.com>
---
drivers/net/bonding/bond_procfs.c | 101 ++++++++++++++++++++------------------
drivers/net/bonding/bond_sysfs.c | 12 ++---
2 files changed, 59 insertions(+), 54 deletions(-)
diff --git a/drivers/net/bonding/bond_procfs.c b/drivers/net/bonding/bond_procfs.c
index e7f3047a26df..f514fe5e80a5 100644
--- a/drivers/net/bonding/bond_procfs.c
+++ b/drivers/net/bonding/bond_procfs.c
@@ -135,27 +135,30 @@ static void bond_info_show_master(struct seq_file *seq)
bond->params.ad_select);
seq_printf(seq, "Aggregator selection policy (ad_select): %s\n",
optval->string);
- seq_printf(seq, "System priority: %d\n",
- BOND_AD_INFO(bond).system.sys_priority);
- seq_printf(seq, "System MAC address: %pM\n",
- &BOND_AD_INFO(bond).system.sys_mac_addr);
-
- if (__bond_3ad_get_active_agg_info(bond, &ad_info)) {
- seq_printf(seq, "bond %s has no active aggregator\n",
- bond->dev->name);
- } else {
- seq_printf(seq, "Active Aggregator Info:\n");
-
- seq_printf(seq, "\tAggregator ID: %d\n",
- ad_info.aggregator_id);
- seq_printf(seq, "\tNumber of ports: %d\n",
- ad_info.ports);
- seq_printf(seq, "\tActor Key: %d\n",
- ad_info.actor_key);
- seq_printf(seq, "\tPartner Key: %d\n",
- ad_info.partner_key);
- seq_printf(seq, "\tPartner Mac Address: %pM\n",
- ad_info.partner_system);
+ if (capable(CAP_NET_ADMIN)) {
+ seq_printf(seq, "System priority: %d\n",
+ BOND_AD_INFO(bond).system.sys_priority);
+ seq_printf(seq, "System MAC address: %pM\n",
+ &BOND_AD_INFO(bond).system.sys_mac_addr);
+
+ if (__bond_3ad_get_active_agg_info(bond, &ad_info)) {
+ seq_printf(seq,
+ "bond %s has no active aggregator\n",
+ bond->dev->name);
+ } else {
+ seq_printf(seq, "Active Aggregator Info:\n");
+
+ seq_printf(seq, "\tAggregator ID: %d\n",
+ ad_info.aggregator_id);
+ seq_printf(seq, "\tNumber of ports: %d\n",
+ ad_info.ports);
+ seq_printf(seq, "\tActor Key: %d\n",
+ ad_info.actor_key);
+ seq_printf(seq, "\tPartner Key: %d\n",
+ ad_info.partner_key);
+ seq_printf(seq, "\tPartner Mac Address: %pM\n",
+ ad_info.partner_system);
+ }
}
}
}
@@ -199,33 +202,35 @@ static void bond_info_show_slave(struct seq_file *seq,
seq_printf(seq, "Partner Churned Count: %d\n",
port->churn_partner_count);
- seq_puts(seq, "details actor lacp pdu:\n");
- seq_printf(seq, " system priority: %d\n",
- port->actor_system_priority);
- seq_printf(seq, " system mac address: %pM\n",
- &port->actor_system);
- seq_printf(seq, " port key: %d\n",
- port->actor_oper_port_key);
- seq_printf(seq, " port priority: %d\n",
- port->actor_port_priority);
- seq_printf(seq, " port number: %d\n",
- port->actor_port_number);
- seq_printf(seq, " port state: %d\n",
- port->actor_oper_port_state);
-
- seq_puts(seq, "details partner lacp pdu:\n");
- seq_printf(seq, " system priority: %d\n",
- port->partner_oper.system_priority);
- seq_printf(seq, " system mac address: %pM\n",
- &port->partner_oper.system);
- seq_printf(seq, " oper key: %d\n",
- port->partner_oper.key);
- seq_printf(seq, " port priority: %d\n",
- port->partner_oper.port_priority);
- seq_printf(seq, " port number: %d\n",
- port->partner_oper.port_number);
- seq_printf(seq, " port state: %d\n",
- port->partner_oper.port_state);
+ if (capable(CAP_NET_ADMIN)) {
+ seq_puts(seq, "details actor lacp pdu:\n");
+ seq_printf(seq, " system priority: %d\n",
+ port->actor_system_priority);
+ seq_printf(seq, " system mac address: %pM\n",
+ &port->actor_system);
+ seq_printf(seq, " port key: %d\n",
+ port->actor_oper_port_key);
+ seq_printf(seq, " port priority: %d\n",
+ port->actor_port_priority);
+ seq_printf(seq, " port number: %d\n",
+ port->actor_port_number);
+ seq_printf(seq, " port state: %d\n",
+ port->actor_oper_port_state);
+
+ seq_puts(seq, "details partner lacp pdu:\n");
+ seq_printf(seq, " system priority: %d\n",
+ port->partner_oper.system_priority);
+ seq_printf(seq, " system mac address: %pM\n",
+ &port->partner_oper.system);
+ seq_printf(seq, " oper key: %d\n",
+ port->partner_oper.key);
+ seq_printf(seq, " port priority: %d\n",
+ port->partner_oper.port_priority);
+ seq_printf(seq, " port number: %d\n",
+ port->partner_oper.port_number);
+ seq_printf(seq, " port state: %d\n",
+ port->partner_oper.port_state);
+ }
} else {
seq_puts(seq, "Aggregator ID: N/A\n");
}
diff --git a/drivers/net/bonding/bond_sysfs.c b/drivers/net/bonding/bond_sysfs.c
index 143a2abd1c1c..31835a4dab57 100644
--- a/drivers/net/bonding/bond_sysfs.c
+++ b/drivers/net/bonding/bond_sysfs.c
@@ -549,7 +549,7 @@ static ssize_t bonding_show_ad_actor_key(struct device *d,
int count = 0;
struct bonding *bond = to_bond(d);
- if (BOND_MODE(bond) == BOND_MODE_8023AD) {
+ if (BOND_MODE(bond) == BOND_MODE_8023AD && capable(CAP_NET_ADMIN)) {
struct ad_info ad_info;
count = sprintf(buf, "%d\n",
bond_3ad_get_active_agg_info(bond, &ad_info)
@@ -569,7 +569,7 @@ static ssize_t bonding_show_ad_partner_key(struct device *d,
int count = 0;
struct bonding *bond = to_bond(d);
- if (BOND_MODE(bond) == BOND_MODE_8023AD) {
+ if (BOND_MODE(bond) == BOND_MODE_8023AD && capable(CAP_NET_ADMIN)) {
struct ad_info ad_info;
count = sprintf(buf, "%d\n",
bond_3ad_get_active_agg_info(bond, &ad_info)
@@ -589,7 +589,7 @@ static ssize_t bonding_show_ad_partner_mac(struct device *d,
int count = 0;
struct bonding *bond = to_bond(d);
- if (BOND_MODE(bond) == BOND_MODE_8023AD) {
+ if (BOND_MODE(bond) == BOND_MODE_8023AD && capable(CAP_NET_ADMIN)) {
struct ad_info ad_info;
if (!bond_3ad_get_active_agg_info(bond, &ad_info))
count = sprintf(buf, "%pM\n", ad_info.partner_system);
@@ -698,7 +698,7 @@ static ssize_t bonding_show_ad_actor_sys_prio(struct device *d,
{
struct bonding *bond = to_bond(d);
- if (BOND_MODE(bond) == BOND_MODE_8023AD)
+ if (BOND_MODE(bond) == BOND_MODE_8023AD && capable(CAP_NET_ADMIN))
return sprintf(buf, "%hu\n", bond->params.ad_actor_sys_prio);
return 0;
@@ -712,7 +712,7 @@ static ssize_t bonding_show_ad_actor_system(struct device *d,
{
struct bonding *bond = to_bond(d);
- if (BOND_MODE(bond) == BOND_MODE_8023AD)
+ if (BOND_MODE(bond) == BOND_MODE_8023AD && capable(CAP_NET_ADMIN))
return sprintf(buf, "%pM\n", bond->params.ad_actor_system);
return 0;
@@ -727,7 +727,7 @@ static ssize_t bonding_show_ad_user_port_key(struct device *d,
{
struct bonding *bond = to_bond(d);
- if (BOND_MODE(bond) == BOND_MODE_8023AD)
+ if (BOND_MODE(bond) == BOND_MODE_8023AD && capable(CAP_NET_ADMIN))
return sprintf(buf, "%hu\n", bond->params.ad_user_port_key);
return 0;
--
2.2.0.rc0.207.ga3a616c
^ permalink raw reply related [flat|nested] 2+ messages in thread* Re: [PATCH next v1] bonding: Display LACP info only to CAP_NET_ADMIN capable user
2015-06-12 19:24 [PATCH next v1] bonding: Display LACP info only to CAP_NET_ADMIN capable user Mahesh Bandewar
@ 2015-06-15 14:08 ` Andy Gospodarek
0 siblings, 0 replies; 2+ messages in thread
From: Andy Gospodarek @ 2015-06-15 14:08 UTC (permalink / raw)
To: Mahesh Bandewar
Cc: Jay Vosburgh, Andy Gospodarek, Veaceslav Falico,
Nikolay Aleksandrov, David Miller, netdev, Eric Dumazet,
Maciej Zenczykowski
On Fri, Jun 12, 2015 at 12:24:47PM -0700, Mahesh Bandewar wrote:
> Actor and Partner details can be accessed via proc-fs and sys-fs
> entries. These interfaces are world readable at this moment. The
> earlier patch-series made the LACP communication secure to avoid
> nuisance attack from within the same L2 domain but it did not
> prevent "someone unprivileged" looking at that information on host
> and perform the same act.
>
> This patch essentially avoids spitting those entries if the user
> in question does not have enough privileges.
Mahesh,
Nik just posted patches to add the ability to add actor_oper_port_state
and partner_oper.port_state to netlink and sysfs. Since you are
restricting the display of those values in /proc and /sys to only those
users with CAP_NET_ADMIN set, there is some overlap that needs to be
resolved.
More importantly Nik's set reminds me that the netlink case for this
restriction also needs to be handled or the functionality desired is
effectively not implemented since a user could query these values via
netlink.
Since Nik's patch is smaller and it should be easy to for you rebase on
top of it, I'm going to ack his and once you pull in his changes and add
netlink support I think your patch should be fine -- as long as there
are no major objections to having a different netlink message returned
based on the netlink user.
-andy
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2015-06-15 14:08 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2015-06-12 19:24 [PATCH next v1] bonding: Display LACP info only to CAP_NET_ADMIN capable user Mahesh Bandewar
2015-06-15 14:08 ` Andy Gospodarek
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).