* [PATCH net] macvlan: disable SIOCSHWTSTAMP in container
@ 2019-05-09 6:54 Hangbin Liu
2019-05-09 13:52 ` Richard Cochran
2019-05-09 16:32 ` David Miller
0 siblings, 2 replies; 3+ messages in thread
From: Hangbin Liu @ 2019-05-09 6:54 UTC (permalink / raw)
To: netdev
Cc: Richard Cochran, Miroslav Lichvar, Jiri Benc, Michal Kubecek,
David Miller, Hangbin Liu
Miroslav pointed that with NET_ADMIN enabled in container, a normal user
could be mapped to root and is able to change the real device's rx
filter via ioctl on macvlan, which would affect the other ptp process on
host. Fix it by disabling SIOCSHWTSTAMP in container.
Fixes: 254c0a2bfedb ("macvlan: pass get_ts_info and SIOC[SG]HWTSTAMP ioctl to real device")
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
---
drivers/net/macvlan.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
index b395423b19bc..92efa93649f0 100644
--- a/drivers/net/macvlan.c
+++ b/drivers/net/macvlan.c
@@ -836,6 +836,8 @@ static int macvlan_do_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
switch (cmd) {
case SIOCSHWTSTAMP:
+ if (!net_eq(dev_net(dev), &init_net))
+ break;
case SIOCGHWTSTAMP:
if (netif_device_present(real_dev) && ops->ndo_do_ioctl)
err = ops->ndo_do_ioctl(real_dev, &ifrr, cmd);
--
2.19.2
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH net] macvlan: disable SIOCSHWTSTAMP in container
2019-05-09 6:54 [PATCH net] macvlan: disable SIOCSHWTSTAMP in container Hangbin Liu
@ 2019-05-09 13:52 ` Richard Cochran
2019-05-09 16:32 ` David Miller
1 sibling, 0 replies; 3+ messages in thread
From: Richard Cochran @ 2019-05-09 13:52 UTC (permalink / raw)
To: Hangbin Liu
Cc: netdev, Miroslav Lichvar, Jiri Benc, Michal Kubecek, David Miller
On Thu, May 09, 2019 at 02:54:08PM +0800, Hangbin Liu wrote:
> Miroslav pointed that with NET_ADMIN enabled in container, a normal user
> could be mapped to root and is able to change the real device's rx
> filter via ioctl on macvlan, which would affect the other ptp process on
> host. Fix it by disabling SIOCSHWTSTAMP in container.
>
> Fixes: 254c0a2bfedb ("macvlan: pass get_ts_info and SIOC[SG]HWTSTAMP ioctl to real device")
> Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Acked-by: Richard Cochran <richardcochran@gmail.com>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH net] macvlan: disable SIOCSHWTSTAMP in container
2019-05-09 6:54 [PATCH net] macvlan: disable SIOCSHWTSTAMP in container Hangbin Liu
2019-05-09 13:52 ` Richard Cochran
@ 2019-05-09 16:32 ` David Miller
1 sibling, 0 replies; 3+ messages in thread
From: David Miller @ 2019-05-09 16:32 UTC (permalink / raw)
To: liuhangbin; +Cc: netdev, richardcochran, mlichvar, jbenc, mkubecek
From: Hangbin Liu <liuhangbin@gmail.com>
Date: Thu, 9 May 2019 14:54:08 +0800
> Miroslav pointed that with NET_ADMIN enabled in container, a normal user
> could be mapped to root and is able to change the real device's rx
> filter via ioctl on macvlan, which would affect the other ptp process on
> host. Fix it by disabling SIOCSHWTSTAMP in container.
>
> Fixes: 254c0a2bfedb ("macvlan: pass get_ts_info and SIOC[SG]HWTSTAMP ioctl to real device")
> Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Applied and queued up for -stable.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2019-05-09 16:32 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2019-05-09 6:54 [PATCH net] macvlan: disable SIOCSHWTSTAMP in container Hangbin Liu
2019-05-09 13:52 ` Richard Cochran
2019-05-09 16:32 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).