From mboxrd@z Thu Jan 1 00:00:00 1970 From: Stephen Hemminger Subject: Re: [PATCH 5/5] net: Use netlink_ns_capable to verify the permisions of netlink messages Date: Thu, 8 May 2014 14:29:39 -0700 Message-ID: <20140508142939.201b3e07@nehalam.linuxnetplumber.net> References: <87d2g7d9ag.fsf_-_@x220.int.ebiederm.org> <536AB151.2070804@dti2.net> <20140507.185256.496391962242529591.davem@davemloft.net> Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Cc: Andy Lutomirski , David Miller , "Jorge Boncompte [DTI2]" , "Eric W. Biederman" , Vivek Goyal , Simo Sorce , "security@kernel.org" , Network Development , "Serge E. Hallyn" To: Linus Torvalds Return-path: Received: from mail-pa0-f42.google.com ([209.85.220.42]:46146 "EHLO mail-pa0-f42.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754738AbaEHV3n (ORCPT ); Thu, 8 May 2014 17:29:43 -0400 Received: by mail-pa0-f42.google.com with SMTP id rd3so3387284pab.1 for ; Thu, 08 May 2014 14:29:43 -0700 (PDT) In-Reply-To: Sender: netdev-owner@vger.kernel.org List-ID: On Wed, 7 May 2014 16:34:08 -0700 Linus Torvalds wrote: > On Wed, May 7, 2014 at 4:01 PM, Andy Lutomirski wrote: > > > > I agree that it should, but it doesn't, and if these patches get > > backported, things will break. OTOH, if the patches don't get > > backported, things may still break, and we have a possibly rather > > severe unfixed vulnerability. > > How did this *use* to work? It looks like it drops permissions after > the bind(), so the actual _IO_ must have always been done without > permissions, no? > > Is it just a bind-time permission check that is now failing, because > it uses the credentials associated with the socket open? If so, I'd > suggest unding just the ns-capable change for bind(), and make that > one always use the current process effective one. > > If you're a suid application, you're not doing "bind()" on random file > descriptors that were passed to you. It's really just read/write that > need to be careful. > > Linus Quagga drops privileges at startup then selectively raises them. The code is doing raise caps in netlink code for bind and each sendto and recvmsg call. Ideally it should be able to not have to raise/lower on each send/recvmsg call.