commit 44ec98ea5ea9cfecd31a5c4cc124703cb5442832 upstream.
The "psample" generic netlink family notifies sampled packets over the "packets" multicast group. This is problematic since by default generic netlink allows non-root users to listen to these notifications.
Fix by marking the group with the 'GENL_UNS_ADMIN_PERM' flag. This will prevent non-root users or root without the 'CAP_NET_ADMIN' capability (in the user namespace owning the network namespace) from joining the group.
Tested using [1].
Before:
# capsh -- -c ./psample_repo # capsh --drop=cap_net_admin -- -c ./psample_repo
After:
# capsh -- -c ./psample_repo # capsh --drop=cap_net_admin -- -c ./psample_repo Failed to join "packets" multicast group
[1] $ cat psample.c #include <stdio.h> #include <netlink/genl/ctrl.h> #include <netlink/genl/genl.h> #include <netlink/socket.h>
int join_grp(struct nl_sock *sk, const char *grp_name) { int grp, err;
grp = genl_ctrl_resolve_grp(sk, "psample", grp_name); if (grp < 0) { fprintf(stderr, "Failed to resolve "%s" multicast group\n", grp_name); return grp; }
err = nl_socket_add_memberships(sk, grp, NFNLGRP_NONE); if (err) { fprintf(stderr, "Failed to join "%s" multicast group\n", grp_name); return err; }
return 0; }
int main(int argc, char **argv) { struct nl_sock *sk; int err;
sk = nl_socket_alloc(); if (!sk) { fprintf(stderr, "Failed to allocate socket\n"); return -1; }
err = genl_connect(sk); if (err) { fprintf(stderr, "Failed to connect socket\n"); return err; }
err = join_grp(sk, "config"); if (err) return err;
err = join_grp(sk, "packets"); if (err) return err;
return 0; } $ gcc -I/usr/include/libnl3 -lnl-3 -lnl-genl-3 -o psample_repo psample.c
Fixes: 6ae0a6286171 ("net: Introduce psample, a new genetlink channel for packet sampling") Reported-by: "The UK's National Cyber Security Centre (NCSC)" security@ncsc.gov.uk Signed-off-by: Ido Schimmel idosch@nvidia.com Reviewed-by: Jacob Keller jacob.e.keller@intel.com Reviewed-by: Jiri Pirko jiri@nvidia.com Link: https://lore.kernel.org/r/20231206213102.1824398-2-idosch@nvidia.com Signed-off-by: Jakub Kicinski kuba@kernel.org --- net/psample/psample.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/net/psample/psample.c b/net/psample/psample.c index 482c07f2766b..5913da77c71d 100644 --- a/net/psample/psample.c +++ b/net/psample/psample.c @@ -30,7 +30,8 @@ enum psample_nl_multicast_groups {
static const struct genl_multicast_group psample_nl_mcgrps[] = { [PSAMPLE_NL_MCGRP_CONFIG] = { .name = PSAMPLE_NL_MCGRP_CONFIG_NAME }, - [PSAMPLE_NL_MCGRP_SAMPLE] = { .name = PSAMPLE_NL_MCGRP_SAMPLE_NAME }, + [PSAMPLE_NL_MCGRP_SAMPLE] = { .name = PSAMPLE_NL_MCGRP_SAMPLE_NAME, + .flags = GENL_UNS_ADMIN_PERM }, };
static struct genl_family psample_nl_family __ro_after_init;