From patchwork Tue Aug 11 02:46:55 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ira Weiny X-Patchwork-Id: 6987781 Return-Path: X-Original-To: patchwork-linux-rdma@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork2.web.kernel.org (Postfix) with ESMTP id 3EACCC05AC for ; Tue, 11 Aug 2015 02:47:09 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 5F33B205C7 for ; Tue, 11 Aug 2015 02:47:08 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 3542B205C4 for ; Tue, 11 Aug 2015 02:47:07 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S933661AbbHKCrD (ORCPT ); Mon, 10 Aug 2015 22:47:03 -0400 Received: from mga11.intel.com ([192.55.52.93]:45036 "EHLO mga11.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932991AbbHKCrA (ORCPT ); Mon, 10 Aug 2015 22:47:00 -0400 Received: from fmsmga003.fm.intel.com ([10.253.24.29]) by fmsmga102.fm.intel.com with ESMTP; 10 Aug 2015 19:46:59 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.15,650,1432623600"; d="scan'208";a="539490939" Received: from phlsvsds.ph.intel.com ([10.228.195.38]) by FMSMGA003.fm.intel.com with ESMTP; 10 Aug 2015 19:47:00 -0700 Received: from phlsvsds.ph.intel.com (localhost.localdomain [127.0.0.1]) by phlsvsds.ph.intel.com (8.13.8/8.13.8) with ESMTP id t7B2kwIu028360; Mon, 10 Aug 2015 22:46:58 -0400 Received: (from iweiny@localhost) by phlsvsds.ph.intel.com (8.13.8/8.13.8/Submit) id t7B2kwVr028355; Mon, 10 Aug 2015 22:46:58 -0400 X-Authentication-Warning: phlsvsds.ph.intel.com: iweiny set sender to ira.weiny@intel.com using -f From: ira.weiny@intel.com To: dledford@redhat.com Cc: linux-rdma@vger.kernel.org, Ira Weiny Subject: [PATCH V2] IB/sa: Restrict SA Netlink to admin users Date: Mon, 10 Aug 2015 22:46:55 -0400 Message-Id: <1439261215-28078-1-git-send-email-ira.weiny@intel.com> X-Mailer: git-send-email 1.7.1 Sender: linux-rdma-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-rdma@vger.kernel.org X-Spam-Status: No, score=-6.9 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_HI, RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: Ira Weiny The recently added SA Netlink service requires admin privileges to receive kernel requests. This is only partially sufficient to protect the kernel from malicious users. This patch fixes two issues. 1) Path responses from user space could be spoofed if the sequence number was properly guessed. 2) The set timeout request message could be issued by any user. Ignore these messages if not submitted by an admin user. Fixes: 6619209af36c ("IB/sa: Route SA pathrecord query through netlink") Signed-off-by: Ira Weiny --- Changes from V1: Use netlink_net_capable rather than ns_capable Doug let me know if you would prefer that I get Kaike to squash this into the original patch. drivers/infiniband/core/sa_query.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/drivers/infiniband/core/sa_query.c b/drivers/infiniband/core/sa_query.c index 70ceec4df02a..6778644a6957 100644 --- a/drivers/infiniband/core/sa_query.c +++ b/drivers/infiniband/core/sa_query.c @@ -699,6 +699,12 @@ static int ib_nl_handle_set_timeout(struct sk_buff *skb, struct nlattr *tb[LS_NLA_TYPE_MAX + 1]; int ret; + if (!netlink_net_capable(skb, CAP_NET_ADMIN)) { + pr_warn_ratelimited("SA netlink: invalid perm for set timeout: `%s'.\n", + current->comm); + return -EPERM; + } + ret = nla_parse(tb, LS_NLA_TYPE_MAX, nlmsg_data(nlh), nlmsg_len(nlh), NULL); attr = (const struct nlattr *)tb[LS_NLA_TYPE_TIMEOUT]; @@ -706,6 +712,9 @@ static int ib_nl_handle_set_timeout(struct sk_buff *skb, goto settimeout_out; timeout = *(int *) nla_data(attr); + + pr_info("SA netlink: timeout: %d\n", timeout); + if (timeout < IB_SA_LOCAL_SVC_TIMEOUT_MIN) timeout = IB_SA_LOCAL_SVC_TIMEOUT_MIN; if (timeout > IB_SA_LOCAL_SVC_TIMEOUT_MAX) @@ -754,6 +763,12 @@ static int ib_nl_handle_resolve_resp(struct sk_buff *skb, int found = 0; int ret; + if (!netlink_net_capable(skb, CAP_NET_ADMIN)) { + pr_warn_ratelimited("SA netlink: invalid perm for response: `%s'.\n", + current->comm); + return -EPERM; + } + spin_lock_irqsave(&ib_nl_request_lock, flags); list_for_each_entry(query, &ib_nl_request_list, list) { /* @@ -770,6 +785,7 @@ static int ib_nl_handle_resolve_resp(struct sk_buff *skb, if (!found) { spin_unlock_irqrestore(&ib_nl_request_lock, flags); + pr_err_ratelimited("SA netlink: got unmatched response\n"); goto resp_out; }