* [PATCH net] vlan: disable SIOCSHWTSTAMP in container
@ 2019-05-09 6:55 Hangbin Liu
2019-05-09 13:52 ` Richard Cochran
2019-05-09 16:32 ` David Miller
0 siblings, 2 replies; 3+ messages in thread
From: Hangbin Liu @ 2019-05-09 6:55 UTC (permalink / raw)
To: netdev
Cc: Richard Cochran, Miroslav Lichvar, Jiri Benc, Michal Kubecek,
David Miller, stefan.sorensen, Hangbin Liu
With NET_ADMIN enabled in container, a normal user could be mapped to
root and is able to change the real device's rx filter via ioctl on
vlan, which would affect the other ptp process on host. Fix it by
disabling SIOCSHWTSTAMP in container.
Fixes: a6111d3c93d0 ("vlan: Pass SIOC[SG]HWTSTAMP ioctls to real device")
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
---
net/8021q/vlan_dev.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
index f044ae56a313..2a9a60733594 100644
--- a/net/8021q/vlan_dev.c
+++ b/net/8021q/vlan_dev.c
@@ -370,10 +370,12 @@ static int vlan_dev_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
ifrr.ifr_ifru = ifr->ifr_ifru;
switch (cmd) {
+ case SIOCSHWTSTAMP:
+ if (!net_eq(dev_net(dev), &init_net))
+ break;
case SIOCGMIIPHY:
case SIOCGMIIREG:
case SIOCSMIIREG:
- case SIOCSHWTSTAMP:
case SIOCGHWTSTAMP:
if (netif_device_present(real_dev) && ops->ndo_do_ioctl)
err = ops->ndo_do_ioctl(real_dev, &ifrr, cmd);
--
2.19.2
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH net] vlan: disable SIOCSHWTSTAMP in container
2019-05-09 6:55 [PATCH net] vlan: disable SIOCSHWTSTAMP in container Hangbin Liu
@ 2019-05-09 13:52 ` Richard Cochran
2019-05-09 16:32 ` David Miller
1 sibling, 0 replies; 3+ messages in thread
From: Richard Cochran @ 2019-05-09 13:52 UTC (permalink / raw)
To: Hangbin Liu
Cc: netdev, Miroslav Lichvar, Jiri Benc, Michal Kubecek, David Miller,
stefan.sorensen
On Thu, May 09, 2019 at 02:55:07PM +0800, Hangbin Liu wrote:
> With NET_ADMIN enabled in container, a normal user could be mapped to
> root and is able to change the real device's rx filter via ioctl on
> vlan, which would affect the other ptp process on host. Fix it by
> disabling SIOCSHWTSTAMP in container.
>
> Fixes: a6111d3c93d0 ("vlan: Pass SIOC[SG]HWTSTAMP ioctls to real device")
> Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Acked-by: Richard Cochran <richardcochran@gmail.com>
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH net] vlan: disable SIOCSHWTSTAMP in container
2019-05-09 6:55 [PATCH net] vlan: disable SIOCSHWTSTAMP in container Hangbin Liu
2019-05-09 13:52 ` Richard Cochran
@ 2019-05-09 16:32 ` David Miller
1 sibling, 0 replies; 3+ messages in thread
From: David Miller @ 2019-05-09 16:32 UTC (permalink / raw)
To: liuhangbin
Cc: netdev, richardcochran, mlichvar, jbenc, mkubecek,
stefan.sorensen
From: Hangbin Liu <liuhangbin@gmail.com>
Date: Thu, 9 May 2019 14:55:07 +0800
> With NET_ADMIN enabled in container, a normal user could be mapped to
> root and is able to change the real device's rx filter via ioctl on
> vlan, which would affect the other ptp process on host. Fix it by
> disabling SIOCSHWTSTAMP in container.
>
> Fixes: a6111d3c93d0 ("vlan: Pass SIOC[SG]HWTSTAMP ioctls to real device")
> Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Applied and queued up for -stable.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2019-05-09 16:32 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2019-05-09 6:55 [PATCH net] vlan: disable SIOCSHWTSTAMP in container Hangbin Liu
2019-05-09 13:52 ` Richard Cochran
2019-05-09 16:32 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).