Re: [PATCH net 1/2] psample: Require 'CAP_NET_ADMIN' when joining "packets" group

[Jacob Keller <jacob.e.keller@intel.com>]

On 12/6/2023 1:31 PM, Ido Schimmel wrote:
> The "psample" generic netlink family notifies sampled packets over the
> "packets" multicast group. This is problematic since by default generic
> netlink allows non-root users to listen to these notifications.
> 
> Fix by marking the group with the 'GENL_UNS_ADMIN_PERM' flag. This will
> prevent non-root users or root without the 'CAP_NET_ADMIN' capability
> (in the user namespace owning the network namespace) from joining the
> group.
> 

Ooh that could be a pretty significant leak. Glad to see it closed.

Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>

Thanks,
Jake

> Tested using [1].
> 
> Before:
> 
>  # capsh -- -c ./psample_repo
>  # capsh --drop=cap_net_admin -- -c ./psample_repo
> 
> After:
> 
>  # capsh -- -c ./psample_repo
>  # capsh --drop=cap_net_admin -- -c ./psample_repo
>  Failed to join "packets" multicast group
> 
> [1]
>  $ cat psample.c
>  #include <stdio.h>
>  #include <netlink/genl/ctrl.h>
>  #include <netlink/genl/genl.h>
>  #include <netlink/socket.h>
> 
>  int join_grp(struct nl_sock *sk, const char *grp_name)
>  {
>  	int grp, err;
> 
>  	grp = genl_ctrl_resolve_grp(sk, "psample", grp_name);
>  	if (grp < 0) {
>  		fprintf(stderr, "Failed to resolve \"%s\" multicast group\n",
>  			grp_name);
>  		return grp;
>  	}
> 
>  	err = nl_socket_add_memberships(sk, grp, NFNLGRP_NONE);
>  	if (err) {
>  		fprintf(stderr, "Failed to join \"%s\" multicast group\n",
>  			grp_name);
>  		return err;
>  	}
> 
>  	return 0;
>  }
> 
>  int main(int argc, char **argv)
>  {
>  	struct nl_sock *sk;
>  	int err;
> 
>  	sk = nl_socket_alloc();
>  	if (!sk) {
>  		fprintf(stderr, "Failed to allocate socket\n");
>  		return -1;
>  	}
> 
>  	err = genl_connect(sk);
>  	if (err) {
>  		fprintf(stderr, "Failed to connect socket\n");
>  		return err;
>  	}
> 
>  	err = join_grp(sk, "config");
>  	if (err)
>  		return err;
> 
>  	err = join_grp(sk, "packets");
>  	if (err)
>  		return err;
> 
>  	return 0;
>  }
>  $ gcc -I/usr/include/libnl3 -lnl-3 -lnl-genl-3 -o psample_repo psample.c
> 
> Fixes: 6ae0a6286171 ("net: Introduce psample, a new genetlink channel for packet sampling")
> Reported-by: "The UK's National Cyber Security Centre (NCSC)" <security@ncsc.gov.uk>
> Signed-off-by: Ido Schimmel <idosch@nvidia.com>
> ---
>  net/psample/psample.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/net/psample/psample.c b/net/psample/psample.c
> index 81a794e36f53..c34e902855db 100644
> --- a/net/psample/psample.c
> +++ b/net/psample/psample.c
> @@ -31,7 +31,8 @@ enum psample_nl_multicast_groups {
>  
>  static const struct genl_multicast_group psample_nl_mcgrps[] = {
>  	[PSAMPLE_NL_MCGRP_CONFIG] = { .name = PSAMPLE_NL_MCGRP_CONFIG_NAME },
> -	[PSAMPLE_NL_MCGRP_SAMPLE] = { .name = PSAMPLE_NL_MCGRP_SAMPLE_NAME },
> +	[PSAMPLE_NL_MCGRP_SAMPLE] = { .name = PSAMPLE_NL_MCGRP_SAMPLE_NAME,
> +				      .flags = GENL_UNS_ADMIN_PERM },
>  };
>  
>  static struct genl_family psample_nl_family __ro_after_init;