Re: [PATCH net 1/2] psample: Require 'CAP_NET_ADMIN' when joining "packets" group

[Jiri Pirko <jiri@resnulli.us>]

Thu, Dec 07, 2023 at 11:16:30AM CET, jhs@mojatatu.com wrote:
>On Wed, Dec 6, 2023 at 4:33 PM Ido Schimmel <idosch@nvidia.com> wrote:
>>
>> The "psample" generic netlink family notifies sampled packets over the
>> "packets" multicast group. This is problematic since by default generic
>> netlink allows non-root users to listen to these notifications.
>>
>> Fix by marking the group with the 'GENL_UNS_ADMIN_PERM' flag. This will
>> prevent non-root users or root without the 'CAP_NET_ADMIN' capability
>> (in the user namespace owning the network namespace) from joining the
>> group.
>>
>
>Out of curiosity, shouldnt reading/getting also be disallowed then?

This is about the sampled packets. You only get them by notifications.


>Traditionally both listening and reading has been allowed without root
>for most netlink endpoints...
>IOW, if i cant listen but am able to dump, isnt whatever "security
>hole" still in play even after this change?
>
>cheers,
>jamal
>
>
>
>> Tested using [1].
>>
>> Before:
>>
>>  # capsh -- -c ./psample_repo
>>  # capsh --drop=cap_net_admin -- -c ./psample_repo
>>
>> After:
>>
>>  # capsh -- -c ./psample_repo
>>  # capsh --drop=cap_net_admin -- -c ./psample_repo
>>  Failed to join "packets" multicast group
>>
>> [1]
>>  $ cat psample.c
>>  #include <stdio.h>
>>  #include <netlink/genl/ctrl.h>
>>  #include <netlink/genl/genl.h>
>>  #include <netlink/socket.h>
>>
>>  int join_grp(struct nl_sock *sk, const char *grp_name)
>>  {
>>         int grp, err;
>>
>>         grp = genl_ctrl_resolve_grp(sk, "psample", grp_name);
>>         if (grp < 0) {
>>                 fprintf(stderr, "Failed to resolve \"%s\" multicast group\n",
>>                         grp_name);
>>                 return grp;
>>         }
>>
>>         err = nl_socket_add_memberships(sk, grp, NFNLGRP_NONE);
>>         if (err) {
>>                 fprintf(stderr, "Failed to join \"%s\" multicast group\n",
>>                         grp_name);
>>                 return err;
>>         }
>>
>>         return 0;
>>  }
>>
>>  int main(int argc, char **argv)
>>  {
>>         struct nl_sock *sk;
>>         int err;
>>
>>         sk = nl_socket_alloc();
>>         if (!sk) {
>>                 fprintf(stderr, "Failed to allocate socket\n");
>>                 return -1;
>>         }
>>
>>         err = genl_connect(sk);
>>         if (err) {
>>                 fprintf(stderr, "Failed to connect socket\n");
>>                 return err;
>>         }
>>
>>         err = join_grp(sk, "config");
>>         if (err)
>>                 return err;
>>
>>         err = join_grp(sk, "packets");
>>         if (err)
>>                 return err;
>>
>>         return 0;
>>  }
>>  $ gcc -I/usr/include/libnl3 -lnl-3 -lnl-genl-3 -o psample_repo psample.c
>>
>> Fixes: 6ae0a6286171 ("net: Introduce psample, a new genetlink channel for packet sampling")
>> Reported-by: "The UK's National Cyber Security Centre (NCSC)" <security@ncsc.gov.uk>
>> Signed-off-by: Ido Schimmel <idosch@nvidia.com>
>> ---
>>  net/psample/psample.c | 3 ++-
>>  1 file changed, 2 insertions(+), 1 deletion(-)
>>
>> diff --git a/net/psample/psample.c b/net/psample/psample.c
>> index 81a794e36f53..c34e902855db 100644
>> --- a/net/psample/psample.c
>> +++ b/net/psample/psample.c
>> @@ -31,7 +31,8 @@ enum psample_nl_multicast_groups {
>>
>>  static const struct genl_multicast_group psample_nl_mcgrps[] = {
>>         [PSAMPLE_NL_MCGRP_CONFIG] = { .name = PSAMPLE_NL_MCGRP_CONFIG_NAME },
>> -       [PSAMPLE_NL_MCGRP_SAMPLE] = { .name = PSAMPLE_NL_MCGRP_SAMPLE_NAME },
>> +       [PSAMPLE_NL_MCGRP_SAMPLE] = { .name = PSAMPLE_NL_MCGRP_SAMPLE_NAME,
>> +                                     .flags = GENL_UNS_ADMIN_PERM },
>>  };
>>
>>  static struct genl_family psample_nl_family __ro_after_init;
>> --
>> 2.40.1
>>