| Message ID | 20231206213102.1824398-2-idosch@nvidia.com (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 44ec98ea5ea9cfecd31a5c4cc124703cb5442832 |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | Generic netlink multicast fixes | expand |
On 12/6/2023 1:31 PM, Ido Schimmel wrote: > The "psample" generic netlink family notifies sampled packets over the > "packets" multicast group. This is problematic since by default generic > netlink allows non-root users to listen to these notifications. > > Fix by marking the group with the 'GENL_UNS_ADMIN_PERM' flag. This will > prevent non-root users or root without the 'CAP_NET_ADMIN' capability > (in the user namespace owning the network namespace) from joining the > group. > Ooh that could be a pretty significant leak. Glad to see it closed. Reviewed-by: Jacob Keller <jacob.e.keller@intel.com> Thanks, Jake > Tested using [1]. > > Before: > > # capsh -- -c ./psample_repo > # capsh --drop=cap_net_admin -- -c ./psample_repo > > After: > > # capsh -- -c ./psample_repo > # capsh --drop=cap_net_admin -- -c ./psample_repo > Failed to join "packets" multicast group > > [1] > $ cat psample.c > #include <stdio.h> > #include <netlink/genl/ctrl.h> > #include <netlink/genl/genl.h> > #include <netlink/socket.h> > > int join_grp(struct nl_sock *sk, const char *grp_name) > { > int grp, err; > > grp = genl_ctrl_resolve_grp(sk, "psample", grp_name); > if (grp < 0) { > fprintf(stderr, "Failed to resolve \"%s\" multicast group\n", > grp_name); > return grp; > } > > err = nl_socket_add_memberships(sk, grp, NFNLGRP_NONE); > if (err) { > fprintf(stderr, "Failed to join \"%s\" multicast group\n", > grp_name); > return err; > } > > return 0; > } > > int main(int argc, char **argv) > { > struct nl_sock *sk; > int err; > > sk = nl_socket_alloc(); > if (!sk) { > fprintf(stderr, "Failed to allocate socket\n"); > return -1; > } > > err = genl_connect(sk); > if (err) { > fprintf(stderr, "Failed to connect socket\n"); > return err; > } > > err = join_grp(sk, "config"); > if (err) > return err; > > err = join_grp(sk, "packets"); > if (err) > return err; > > return 0; > } > $ gcc -I/usr/include/libnl3 -lnl-3 -lnl-genl-3 -o psample_repo psample.c > > Fixes: 6ae0a6286171 ("net: Introduce psample, a new genetlink channel for packet sampling") > Reported-by: "The UK's National Cyber Security Centre (NCSC)" <security@ncsc.gov.uk> > Signed-off-by: Ido Schimmel <idosch@nvidia.com> > --- > net/psample/psample.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/net/psample/psample.c b/net/psample/psample.c > index 81a794e36f53..c34e902855db 100644 > --- a/net/psample/psample.c > +++ b/net/psample/psample.c > @@ -31,7 +31,8 @@ enum psample_nl_multicast_groups { > > static const struct genl_multicast_group psample_nl_mcgrps[] = { > [PSAMPLE_NL_MCGRP_CONFIG] = { .name = PSAMPLE_NL_MCGRP_CONFIG_NAME }, > - [PSAMPLE_NL_MCGRP_SAMPLE] = { .name = PSAMPLE_NL_MCGRP_SAMPLE_NAME }, > + [PSAMPLE_NL_MCGRP_SAMPLE] = { .name = PSAMPLE_NL_MCGRP_SAMPLE_NAME, > + .flags = GENL_UNS_ADMIN_PERM }, > }; > > static struct genl_family psample_nl_family __ro_after_init;
On Wed, Dec 6, 2023 at 4:33 PM Ido Schimmel <idosch@nvidia.com> wrote: > > The "psample" generic netlink family notifies sampled packets over the > "packets" multicast group. This is problematic since by default generic > netlink allows non-root users to listen to these notifications. > > Fix by marking the group with the 'GENL_UNS_ADMIN_PERM' flag. This will > prevent non-root users or root without the 'CAP_NET_ADMIN' capability > (in the user namespace owning the network namespace) from joining the > group. > Out of curiosity, shouldnt reading/getting also be disallowed then? Traditionally both listening and reading has been allowed without root for most netlink endpoints... IOW, if i cant listen but am able to dump, isnt whatever "security hole" still in play even after this change? cheers, jamal > Tested using [1]. > > Before: > > # capsh -- -c ./psample_repo > # capsh --drop=cap_net_admin -- -c ./psample_repo > > After: > > # capsh -- -c ./psample_repo > # capsh --drop=cap_net_admin -- -c ./psample_repo > Failed to join "packets" multicast group > > [1] > $ cat psample.c > #include <stdio.h> > #include <netlink/genl/ctrl.h> > #include <netlink/genl/genl.h> > #include <netlink/socket.h> > > int join_grp(struct nl_sock *sk, const char *grp_name) > { > int grp, err; > > grp = genl_ctrl_resolve_grp(sk, "psample", grp_name); > if (grp < 0) { > fprintf(stderr, "Failed to resolve \"%s\" multicast group\n", > grp_name); > return grp; > } > > err = nl_socket_add_memberships(sk, grp, NFNLGRP_NONE); > if (err) { > fprintf(stderr, "Failed to join \"%s\" multicast group\n", > grp_name); > return err; > } > > return 0; > } > > int main(int argc, char **argv) > { > struct nl_sock *sk; > int err; > > sk = nl_socket_alloc(); > if (!sk) { > fprintf(stderr, "Failed to allocate socket\n"); > return -1; > } > > err = genl_connect(sk); > if (err) { > fprintf(stderr, "Failed to connect socket\n"); > return err; > } > > err = join_grp(sk, "config"); > if (err) > return err; > > err = join_grp(sk, "packets"); > if (err) > return err; > > return 0; > } > $ gcc -I/usr/include/libnl3 -lnl-3 -lnl-genl-3 -o psample_repo psample.c > > Fixes: 6ae0a6286171 ("net: Introduce psample, a new genetlink channel for packet sampling") > Reported-by: "The UK's National Cyber Security Centre (NCSC)" <security@ncsc.gov.uk> > Signed-off-by: Ido Schimmel <idosch@nvidia.com> > --- > net/psample/psample.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/net/psample/psample.c b/net/psample/psample.c > index 81a794e36f53..c34e902855db 100644 > --- a/net/psample/psample.c > +++ b/net/psample/psample.c > @@ -31,7 +31,8 @@ enum psample_nl_multicast_groups { > > static const struct genl_multicast_group psample_nl_mcgrps[] = { > [PSAMPLE_NL_MCGRP_CONFIG] = { .name = PSAMPLE_NL_MCGRP_CONFIG_NAME }, > - [PSAMPLE_NL_MCGRP_SAMPLE] = { .name = PSAMPLE_NL_MCGRP_SAMPLE_NAME }, > + [PSAMPLE_NL_MCGRP_SAMPLE] = { .name = PSAMPLE_NL_MCGRP_SAMPLE_NAME, > + .flags = GENL_UNS_ADMIN_PERM }, > }; > > static struct genl_family psample_nl_family __ro_after_init; > -- > 2.40.1 >
Wed, Dec 06, 2023 at 10:31:01PM CET, idosch@nvidia.com wrote: >The "psample" generic netlink family notifies sampled packets over the >"packets" multicast group. This is problematic since by default generic >netlink allows non-root users to listen to these notifications. > >Fix by marking the group with the 'GENL_UNS_ADMIN_PERM' flag. This will >prevent non-root users or root without the 'CAP_NET_ADMIN' capability >(in the user namespace owning the network namespace) from joining the >group. > >Tested using [1]. > >Before: > > # capsh -- -c ./psample_repo > # capsh --drop=cap_net_admin -- -c ./psample_repo > >After: > > # capsh -- -c ./psample_repo > # capsh --drop=cap_net_admin -- -c ./psample_repo > Failed to join "packets" multicast group > >[1] > $ cat psample.c > #include <stdio.h> > #include <netlink/genl/ctrl.h> > #include <netlink/genl/genl.h> > #include <netlink/socket.h> > > int join_grp(struct nl_sock *sk, const char *grp_name) > { > int grp, err; > > grp = genl_ctrl_resolve_grp(sk, "psample", grp_name); > if (grp < 0) { > fprintf(stderr, "Failed to resolve \"%s\" multicast group\n", > grp_name); > return grp; > } > > err = nl_socket_add_memberships(sk, grp, NFNLGRP_NONE); > if (err) { > fprintf(stderr, "Failed to join \"%s\" multicast group\n", > grp_name); > return err; > } > > return 0; > } > > int main(int argc, char **argv) > { > struct nl_sock *sk; > int err; > > sk = nl_socket_alloc(); > if (!sk) { > fprintf(stderr, "Failed to allocate socket\n"); > return -1; > } > > err = genl_connect(sk); > if (err) { > fprintf(stderr, "Failed to connect socket\n"); > return err; > } > > err = join_grp(sk, "config"); > if (err) > return err; > > err = join_grp(sk, "packets"); > if (err) > return err; > > return 0; > } > $ gcc -I/usr/include/libnl3 -lnl-3 -lnl-genl-3 -o psample_repo psample.c > >Fixes: 6ae0a6286171 ("net: Introduce psample, a new genetlink channel for packet sampling") >Reported-by: "The UK's National Cyber Security Centre (NCSC)" <security@ncsc.gov.uk> >Signed-off-by: Ido Schimmel <idosch@nvidia.com> Reviewed-by: Jiri Pirko <jiri@nvidia.com>
Thu, Dec 07, 2023 at 11:16:30AM CET, jhs@mojatatu.com wrote: >On Wed, Dec 6, 2023 at 4:33 PM Ido Schimmel <idosch@nvidia.com> wrote: >> >> The "psample" generic netlink family notifies sampled packets over the >> "packets" multicast group. This is problematic since by default generic >> netlink allows non-root users to listen to these notifications. >> >> Fix by marking the group with the 'GENL_UNS_ADMIN_PERM' flag. This will >> prevent non-root users or root without the 'CAP_NET_ADMIN' capability >> (in the user namespace owning the network namespace) from joining the >> group. >> > >Out of curiosity, shouldnt reading/getting also be disallowed then? This is about the sampled packets. You only get them by notifications. >Traditionally both listening and reading has been allowed without root >for most netlink endpoints... >IOW, if i cant listen but am able to dump, isnt whatever "security >hole" still in play even after this change? > >cheers, >jamal > > > >> Tested using [1]. >> >> Before: >> >> # capsh -- -c ./psample_repo >> # capsh --drop=cap_net_admin -- -c ./psample_repo >> >> After: >> >> # capsh -- -c ./psample_repo >> # capsh --drop=cap_net_admin -- -c ./psample_repo >> Failed to join "packets" multicast group >> >> [1] >> $ cat psample.c >> #include <stdio.h> >> #include <netlink/genl/ctrl.h> >> #include <netlink/genl/genl.h> >> #include <netlink/socket.h> >> >> int join_grp(struct nl_sock *sk, const char *grp_name) >> { >> int grp, err; >> >> grp = genl_ctrl_resolve_grp(sk, "psample", grp_name); >> if (grp < 0) { >> fprintf(stderr, "Failed to resolve \"%s\" multicast group\n", >> grp_name); >> return grp; >> } >> >> err = nl_socket_add_memberships(sk, grp, NFNLGRP_NONE); >> if (err) { >> fprintf(stderr, "Failed to join \"%s\" multicast group\n", >> grp_name); >> return err; >> } >> >> return 0; >> } >> >> int main(int argc, char **argv) >> { >> struct nl_sock *sk; >> int err; >> >> sk = nl_socket_alloc(); >> if (!sk) { >> fprintf(stderr, "Failed to allocate socket\n"); >> return -1; >> } >> >> err = genl_connect(sk); >> if (err) { >> fprintf(stderr, "Failed to connect socket\n"); >> return err; >> } >> >> err = join_grp(sk, "config"); >> if (err) >> return err; >> >> err = join_grp(sk, "packets"); >> if (err) >> return err; >> >> return 0; >> } >> $ gcc -I/usr/include/libnl3 -lnl-3 -lnl-genl-3 -o psample_repo psample.c >> >> Fixes: 6ae0a6286171 ("net: Introduce psample, a new genetlink channel for packet sampling") >> Reported-by: "The UK's National Cyber Security Centre (NCSC)" <security@ncsc.gov.uk> >> Signed-off-by: Ido Schimmel <idosch@nvidia.com> >> --- >> net/psample/psample.c | 3 ++- >> 1 file changed, 2 insertions(+), 1 deletion(-) >> >> diff --git a/net/psample/psample.c b/net/psample/psample.c >> index 81a794e36f53..c34e902855db 100644 >> --- a/net/psample/psample.c >> +++ b/net/psample/psample.c >> @@ -31,7 +31,8 @@ enum psample_nl_multicast_groups { >> >> static const struct genl_multicast_group psample_nl_mcgrps[] = { >> [PSAMPLE_NL_MCGRP_CONFIG] = { .name = PSAMPLE_NL_MCGRP_CONFIG_NAME }, >> - [PSAMPLE_NL_MCGRP_SAMPLE] = { .name = PSAMPLE_NL_MCGRP_SAMPLE_NAME }, >> + [PSAMPLE_NL_MCGRP_SAMPLE] = { .name = PSAMPLE_NL_MCGRP_SAMPLE_NAME, >> + .flags = GENL_UNS_ADMIN_PERM }, >> }; >> >> static struct genl_family psample_nl_family __ro_after_init; >> -- >> 2.40.1 >>
diff --git a/net/psample/psample.c b/net/psample/psample.c index 81a794e36f53..c34e902855db 100644 --- a/net/psample/psample.c +++ b/net/psample/psample.c @@ -31,7 +31,8 @@ enum psample_nl_multicast_groups { static const struct genl_multicast_group psample_nl_mcgrps[] = { [PSAMPLE_NL_MCGRP_CONFIG] = { .name = PSAMPLE_NL_MCGRP_CONFIG_NAME }, - [PSAMPLE_NL_MCGRP_SAMPLE] = { .name = PSAMPLE_NL_MCGRP_SAMPLE_NAME }, + [PSAMPLE_NL_MCGRP_SAMPLE] = { .name = PSAMPLE_NL_MCGRP_SAMPLE_NAME, + .flags = GENL_UNS_ADMIN_PERM }, }; static struct genl_family psample_nl_family __ro_after_init;
The "psample" generic netlink family notifies sampled packets over the "packets" multicast group. This is problematic since by default generic netlink allows non-root users to listen to these notifications. Fix by marking the group with the 'GENL_UNS_ADMIN_PERM' flag. This will prevent non-root users or root without the 'CAP_NET_ADMIN' capability (in the user namespace owning the network namespace) from joining the group. Tested using [1]. Before: # capsh -- -c ./psample_repo # capsh --drop=cap_net_admin -- -c ./psample_repo After: # capsh -- -c ./psample_repo # capsh --drop=cap_net_admin -- -c ./psample_repo Failed to join "packets" multicast group [1] $ cat psample.c #include <stdio.h> #include <netlink/genl/ctrl.h> #include <netlink/genl/genl.h> #include <netlink/socket.h> int join_grp(struct nl_sock *sk, const char *grp_name) { int grp, err; grp = genl_ctrl_resolve_grp(sk, "psample", grp_name); if (grp < 0) { fprintf(stderr, "Failed to resolve \"%s\" multicast group\n", grp_name); return grp; } err = nl_socket_add_memberships(sk, grp, NFNLGRP_NONE); if (err) { fprintf(stderr, "Failed to join \"%s\" multicast group\n", grp_name); return err; } return 0; } int main(int argc, char **argv) { struct nl_sock *sk; int err; sk = nl_socket_alloc(); if (!sk) { fprintf(stderr, "Failed to allocate socket\n"); return -1; } err = genl_connect(sk); if (err) { fprintf(stderr, "Failed to connect socket\n"); return err; } err = join_grp(sk, "config"); if (err) return err; err = join_grp(sk, "packets"); if (err) return err; return 0; } $ gcc -I/usr/include/libnl3 -lnl-3 -lnl-genl-3 -o psample_repo psample.c Fixes: 6ae0a6286171 ("net: Introduce psample, a new genetlink channel for packet sampling") Reported-by: "The UK's National Cyber Security Centre (NCSC)" <security@ncsc.gov.uk> Signed-off-by: Ido Schimmel <idosch@nvidia.com> --- net/psample/psample.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)