From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-bn3nam01on0113.outbound.protection.outlook.com ([104.47.33.113]:60480 "EHLO NAM01-BN3-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1753471AbeA1W1s (ORCPT ); Sun, 28 Jan 2018 17:27:48 -0500 From: Sasha Levin To: "linux-kernel@vger.kernel.org" , "stable@vger.kernel.org" CC: Kevin Cernekee , Pablo Neira Ayuso , Sasha Levin Subject: [PATCH AUTOSEL for 4.14 078/100] netfilter: nfnetlink_cthelper: Add missing permission checks Date: Sun, 28 Jan 2018 22:26:49 +0000 Message-ID: <20180128222547.7398-78-alexander.levin@microsoft.com> References: <20180128222547.7398-1-alexander.levin@microsoft.com> In-Reply-To: <20180128222547.7398-1-alexander.levin@microsoft.com> Content-Language: en-US Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org List-ID: From: Kevin Cernekee [ Upstream commit 4b380c42f7d00a395feede754f0bc2292eebe6e5 ] The capability check in nfnetlink_rcv() verifies that the caller has CAP_NET_ADMIN in the namespace that "owns" the netlink socket. However, nfnl_cthelper_list is shared by all net namespaces on the system. An unprivileged user can create user and net namespaces in which he holds CAP_NET_ADMIN to bypass the netlink_net_capable() check: $ nfct helper list nfct v1.4.4: netlink error: Operation not permitted $ vpnns -- nfct helper list { .name =3D ftp, .queuenum =3D 0, .l3protonum =3D 2, .l4protonum =3D 6, .priv_data_len =3D 24, .status =3D enabled, }; Add capable() checks in nfnetlink_cthelper, as this is cleaner than trying to generalize the solution. Signed-off-by: Kevin Cernekee Signed-off-by: Pablo Neira Ayuso Signed-off-by: Sasha Levin --- net/netfilter/nfnetlink_cthelper.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/net/netfilter/nfnetlink_cthelper.c b/net/netfilter/nfnetlink_c= thelper.c index 41628b393673..d33ce6d5ebce 100644 --- a/net/netfilter/nfnetlink_cthelper.c +++ b/net/netfilter/nfnetlink_cthelper.c @@ -17,6 +17,7 @@ #include #include #include +#include #include #include =20 @@ -407,6 +408,9 @@ static int nfnl_cthelper_new(struct net *net, struct so= ck *nfnl, struct nfnl_cthelper *nlcth; int ret =3D 0; =20 + if (!capable(CAP_NET_ADMIN)) + return -EPERM; + if (!tb[NFCTH_NAME] || !tb[NFCTH_TUPLE]) return -EINVAL; =20 @@ -611,6 +615,9 @@ static int nfnl_cthelper_get(struct net *net, struct so= ck *nfnl, struct nfnl_cthelper *nlcth; bool tuple_set =3D false; =20 + if (!capable(CAP_NET_ADMIN)) + return -EPERM; + if (nlh->nlmsg_flags & NLM_F_DUMP) { struct netlink_dump_control c =3D { .dump =3D nfnl_cthelper_dump_table, @@ -678,6 +685,9 @@ static int nfnl_cthelper_del(struct net *net, struct so= ck *nfnl, struct nfnl_cthelper *nlcth, *n; int j =3D 0, ret; =20 + if (!capable(CAP_NET_ADMIN)) + return -EPERM; + if (tb[NFCTH_NAME]) helper_name =3D nla_data(tb[NFCTH_NAME]); =20 --=20 2.11.0