Re: [PATCH net 1/2] psample: Require 'CAP_NET_ADMIN' when joining "packets" group

[Jiri Pirko <jiri@resnulli.us>]

Wed, Dec 06, 2023 at 10:31:01PM CET, idosch@nvidia.com wrote:
>The "psample" generic netlink family notifies sampled packets over the
>"packets" multicast group. This is problematic since by default generic
>netlink allows non-root users to listen to these notifications.
>
>Fix by marking the group with the 'GENL_UNS_ADMIN_PERM' flag. This will
>prevent non-root users or root without the 'CAP_NET_ADMIN' capability
>(in the user namespace owning the network namespace) from joining the
>group.
>
>Tested using [1].
>
>Before:
>
> # capsh -- -c ./psample_repo
> # capsh --drop=cap_net_admin -- -c ./psample_repo
>
>After:
>
> # capsh -- -c ./psample_repo
> # capsh --drop=cap_net_admin -- -c ./psample_repo
> Failed to join "packets" multicast group
>
>[1]
> $ cat psample.c
> #include <stdio.h>
> #include <netlink/genl/ctrl.h>
> #include <netlink/genl/genl.h>
> #include <netlink/socket.h>
>
> int join_grp(struct nl_sock *sk, const char *grp_name)
> {
> 	int grp, err;
>
> 	grp = genl_ctrl_resolve_grp(sk, "psample", grp_name);
> 	if (grp < 0) {
> 		fprintf(stderr, "Failed to resolve \"%s\" multicast group\n",
> 			grp_name);
> 		return grp;
> 	}
>
> 	err = nl_socket_add_memberships(sk, grp, NFNLGRP_NONE);
> 	if (err) {
> 		fprintf(stderr, "Failed to join \"%s\" multicast group\n",
> 			grp_name);
> 		return err;
> 	}
>
> 	return 0;
> }
>
> int main(int argc, char **argv)
> {
> 	struct nl_sock *sk;
> 	int err;
>
> 	sk = nl_socket_alloc();
> 	if (!sk) {
> 		fprintf(stderr, "Failed to allocate socket\n");
> 		return -1;
> 	}
>
> 	err = genl_connect(sk);
> 	if (err) {
> 		fprintf(stderr, "Failed to connect socket\n");
> 		return err;
> 	}
>
> 	err = join_grp(sk, "config");
> 	if (err)
> 		return err;
>
> 	err = join_grp(sk, "packets");
> 	if (err)
> 		return err;
>
> 	return 0;
> }
> $ gcc -I/usr/include/libnl3 -lnl-3 -lnl-genl-3 -o psample_repo psample.c
>
>Fixes: 6ae0a6286171 ("net: Introduce psample, a new genetlink channel for packet sampling")
>Reported-by: "The UK's National Cyber Security Centre (NCSC)" <security@ncsc.gov.uk>
>Signed-off-by: Ido Schimmel <idosch@nvidia.com>

Reviewed-by: Jiri Pirko <jiri@nvidia.com>