* [PATCH next v2] bonding: Display LACP info only to CAP_NET_ADMIN capable user
@ 2015-06-18 0:59 Mahesh Bandewar
2015-06-18 11:17 ` Eric Dumazet
0 siblings, 1 reply; 4+ messages in thread
From: Mahesh Bandewar @ 2015-06-18 0:59 UTC (permalink / raw)
To: Jay Vosburgh, Andy Gospodarek, Veaceslav Falico,
Nikolay Aleksandrov, David Miller
Cc: Mahesh Bandewar, netdev
Actor and Partner details can be accessed via proc-fs, sys-fs
entries or netlink interface. These interfaces are world readable
at this moment. The earlier patch-series made the LACP communication
secure to avoid nuisance attack from within the same L2 domain but
it did not prevent "someone unprivileged" looking at that information
on host and perform the same act.
This patch essentially avoids spitting those entries if the user
in question does not have enough privileges.
Signed-off-by: Mahesh Bandewar <maheshb@google.com>
---
drivers/net/bonding/bond_netlink.c | 11 ++--
drivers/net/bonding/bond_procfs.c | 101 +++++++++++++++++++------------------
drivers/net/bonding/bond_sysfs.c | 12 ++---
3 files changed, 67 insertions(+), 57 deletions(-)
diff --git a/drivers/net/bonding/bond_netlink.c b/drivers/net/bonding/bond_netlink.c
index 5580fcde738f..3fd3aa4b145e 100644
--- a/drivers/net/bonding/bond_netlink.c
+++ b/drivers/net/bonding/bond_netlink.c
@@ -600,18 +600,23 @@ static int bond_fill_info(struct sk_buff *skb,
if (BOND_MODE(bond) == BOND_MODE_8023AD) {
struct ad_info info;
+ u8 zero_mac[ETH_ALEN];
+ eth_zero_addr(zero_mac);
if (nla_put_u16(skb, IFLA_BOND_AD_ACTOR_SYS_PRIO,
- bond->params.ad_actor_sys_prio))
+ capable(CAP_NET_ADMIN) ?
+ bond->params.ad_actor_sys_prio : 0))
goto nla_put_failure;
if (nla_put_u16(skb, IFLA_BOND_AD_USER_PORT_KEY,
- bond->params.ad_user_port_key))
+ capable(CAP_NET_ADMIN) ?
+ bond->params.ad_user_port_key : 0))
goto nla_put_failure;
if (nla_put(skb, IFLA_BOND_AD_ACTOR_SYSTEM,
sizeof(bond->params.ad_actor_system),
- &bond->params.ad_actor_system))
+ capable(CAP_NET_ADMIN) ?
+ &bond->params.ad_actor_system : &zero_mac))
goto nla_put_failure;
if (!bond_3ad_get_active_agg_info(bond, &info)) {
diff --git a/drivers/net/bonding/bond_procfs.c b/drivers/net/bonding/bond_procfs.c
index e7f3047a26df..f514fe5e80a5 100644
--- a/drivers/net/bonding/bond_procfs.c
+++ b/drivers/net/bonding/bond_procfs.c
@@ -135,27 +135,30 @@ static void bond_info_show_master(struct seq_file *seq)
bond->params.ad_select);
seq_printf(seq, "Aggregator selection policy (ad_select): %s\n",
optval->string);
- seq_printf(seq, "System priority: %d\n",
- BOND_AD_INFO(bond).system.sys_priority);
- seq_printf(seq, "System MAC address: %pM\n",
- &BOND_AD_INFO(bond).system.sys_mac_addr);
-
- if (__bond_3ad_get_active_agg_info(bond, &ad_info)) {
- seq_printf(seq, "bond %s has no active aggregator\n",
- bond->dev->name);
- } else {
- seq_printf(seq, "Active Aggregator Info:\n");
-
- seq_printf(seq, "\tAggregator ID: %d\n",
- ad_info.aggregator_id);
- seq_printf(seq, "\tNumber of ports: %d\n",
- ad_info.ports);
- seq_printf(seq, "\tActor Key: %d\n",
- ad_info.actor_key);
- seq_printf(seq, "\tPartner Key: %d\n",
- ad_info.partner_key);
- seq_printf(seq, "\tPartner Mac Address: %pM\n",
- ad_info.partner_system);
+ if (capable(CAP_NET_ADMIN)) {
+ seq_printf(seq, "System priority: %d\n",
+ BOND_AD_INFO(bond).system.sys_priority);
+ seq_printf(seq, "System MAC address: %pM\n",
+ &BOND_AD_INFO(bond).system.sys_mac_addr);
+
+ if (__bond_3ad_get_active_agg_info(bond, &ad_info)) {
+ seq_printf(seq,
+ "bond %s has no active aggregator\n",
+ bond->dev->name);
+ } else {
+ seq_printf(seq, "Active Aggregator Info:\n");
+
+ seq_printf(seq, "\tAggregator ID: %d\n",
+ ad_info.aggregator_id);
+ seq_printf(seq, "\tNumber of ports: %d\n",
+ ad_info.ports);
+ seq_printf(seq, "\tActor Key: %d\n",
+ ad_info.actor_key);
+ seq_printf(seq, "\tPartner Key: %d\n",
+ ad_info.partner_key);
+ seq_printf(seq, "\tPartner Mac Address: %pM\n",
+ ad_info.partner_system);
+ }
}
}
}
@@ -199,33 +202,35 @@ static void bond_info_show_slave(struct seq_file *seq,
seq_printf(seq, "Partner Churned Count: %d\n",
port->churn_partner_count);
- seq_puts(seq, "details actor lacp pdu:\n");
- seq_printf(seq, " system priority: %d\n",
- port->actor_system_priority);
- seq_printf(seq, " system mac address: %pM\n",
- &port->actor_system);
- seq_printf(seq, " port key: %d\n",
- port->actor_oper_port_key);
- seq_printf(seq, " port priority: %d\n",
- port->actor_port_priority);
- seq_printf(seq, " port number: %d\n",
- port->actor_port_number);
- seq_printf(seq, " port state: %d\n",
- port->actor_oper_port_state);
-
- seq_puts(seq, "details partner lacp pdu:\n");
- seq_printf(seq, " system priority: %d\n",
- port->partner_oper.system_priority);
- seq_printf(seq, " system mac address: %pM\n",
- &port->partner_oper.system);
- seq_printf(seq, " oper key: %d\n",
- port->partner_oper.key);
- seq_printf(seq, " port priority: %d\n",
- port->partner_oper.port_priority);
- seq_printf(seq, " port number: %d\n",
- port->partner_oper.port_number);
- seq_printf(seq, " port state: %d\n",
- port->partner_oper.port_state);
+ if (capable(CAP_NET_ADMIN)) {
+ seq_puts(seq, "details actor lacp pdu:\n");
+ seq_printf(seq, " system priority: %d\n",
+ port->actor_system_priority);
+ seq_printf(seq, " system mac address: %pM\n",
+ &port->actor_system);
+ seq_printf(seq, " port key: %d\n",
+ port->actor_oper_port_key);
+ seq_printf(seq, " port priority: %d\n",
+ port->actor_port_priority);
+ seq_printf(seq, " port number: %d\n",
+ port->actor_port_number);
+ seq_printf(seq, " port state: %d\n",
+ port->actor_oper_port_state);
+
+ seq_puts(seq, "details partner lacp pdu:\n");
+ seq_printf(seq, " system priority: %d\n",
+ port->partner_oper.system_priority);
+ seq_printf(seq, " system mac address: %pM\n",
+ &port->partner_oper.system);
+ seq_printf(seq, " oper key: %d\n",
+ port->partner_oper.key);
+ seq_printf(seq, " port priority: %d\n",
+ port->partner_oper.port_priority);
+ seq_printf(seq, " port number: %d\n",
+ port->partner_oper.port_number);
+ seq_printf(seq, " port state: %d\n",
+ port->partner_oper.port_state);
+ }
} else {
seq_puts(seq, "Aggregator ID: N/A\n");
}
diff --git a/drivers/net/bonding/bond_sysfs.c b/drivers/net/bonding/bond_sysfs.c
index 143a2abd1c1c..31835a4dab57 100644
--- a/drivers/net/bonding/bond_sysfs.c
+++ b/drivers/net/bonding/bond_sysfs.c
@@ -549,7 +549,7 @@ static ssize_t bonding_show_ad_actor_key(struct device *d,
int count = 0;
struct bonding *bond = to_bond(d);
- if (BOND_MODE(bond) == BOND_MODE_8023AD) {
+ if (BOND_MODE(bond) == BOND_MODE_8023AD && capable(CAP_NET_ADMIN)) {
struct ad_info ad_info;
count = sprintf(buf, "%d\n",
bond_3ad_get_active_agg_info(bond, &ad_info)
@@ -569,7 +569,7 @@ static ssize_t bonding_show_ad_partner_key(struct device *d,
int count = 0;
struct bonding *bond = to_bond(d);
- if (BOND_MODE(bond) == BOND_MODE_8023AD) {
+ if (BOND_MODE(bond) == BOND_MODE_8023AD && capable(CAP_NET_ADMIN)) {
struct ad_info ad_info;
count = sprintf(buf, "%d\n",
bond_3ad_get_active_agg_info(bond, &ad_info)
@@ -589,7 +589,7 @@ static ssize_t bonding_show_ad_partner_mac(struct device *d,
int count = 0;
struct bonding *bond = to_bond(d);
- if (BOND_MODE(bond) == BOND_MODE_8023AD) {
+ if (BOND_MODE(bond) == BOND_MODE_8023AD && capable(CAP_NET_ADMIN)) {
struct ad_info ad_info;
if (!bond_3ad_get_active_agg_info(bond, &ad_info))
count = sprintf(buf, "%pM\n", ad_info.partner_system);
@@ -698,7 +698,7 @@ static ssize_t bonding_show_ad_actor_sys_prio(struct device *d,
{
struct bonding *bond = to_bond(d);
- if (BOND_MODE(bond) == BOND_MODE_8023AD)
+ if (BOND_MODE(bond) == BOND_MODE_8023AD && capable(CAP_NET_ADMIN))
return sprintf(buf, "%hu\n", bond->params.ad_actor_sys_prio);
return 0;
@@ -712,7 +712,7 @@ static ssize_t bonding_show_ad_actor_system(struct device *d,
{
struct bonding *bond = to_bond(d);
- if (BOND_MODE(bond) == BOND_MODE_8023AD)
+ if (BOND_MODE(bond) == BOND_MODE_8023AD && capable(CAP_NET_ADMIN))
return sprintf(buf, "%pM\n", bond->params.ad_actor_system);
return 0;
@@ -727,7 +727,7 @@ static ssize_t bonding_show_ad_user_port_key(struct device *d,
{
struct bonding *bond = to_bond(d);
- if (BOND_MODE(bond) == BOND_MODE_8023AD)
+ if (BOND_MODE(bond) == BOND_MODE_8023AD && capable(CAP_NET_ADMIN))
return sprintf(buf, "%hu\n", bond->params.ad_user_port_key);
return 0;
--
2.4.3.573.g4eafbef
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH next v2] bonding: Display LACP info only to CAP_NET_ADMIN capable user
2015-06-18 0:59 [PATCH next v2] bonding: Display LACP info only to CAP_NET_ADMIN capable user Mahesh Bandewar
@ 2015-06-18 11:17 ` Eric Dumazet
2015-06-18 14:41 ` Andy Gospodarek
0 siblings, 1 reply; 4+ messages in thread
From: Eric Dumazet @ 2015-06-18 11:17 UTC (permalink / raw)
To: Mahesh Bandewar
Cc: Jay Vosburgh, Andy Gospodarek, Veaceslav Falico,
Nikolay Aleksandrov, David Miller, netdev
On Wed, 2015-06-17 at 17:59 -0700, Mahesh Bandewar wrote:
> Actor and Partner details can be accessed via proc-fs, sys-fs
> entries or netlink interface. These interfaces are world readable
> at this moment. The earlier patch-series made the LACP communication
> secure to avoid nuisance attack from within the same L2 domain but
> it did not prevent "someone unprivileged" looking at that information
> on host and perform the same act.
>
> This patch essentially avoids spitting those entries if the user
> in question does not have enough privileges.
>
> Signed-off-by: Mahesh Bandewar <maheshb@google.com>
> ---
> drivers/net/bonding/bond_netlink.c | 11 ++--
> drivers/net/bonding/bond_procfs.c | 101 +++++++++++++++++++------------------
> drivers/net/bonding/bond_sysfs.c | 12 ++---
> 3 files changed, 67 insertions(+), 57 deletions(-)
>
> diff --git a/drivers/net/bonding/bond_netlink.c b/drivers/net/bonding/bond_netlink.c
> index 5580fcde738f..3fd3aa4b145e 100644
> --- a/drivers/net/bonding/bond_netlink.c
> +++ b/drivers/net/bonding/bond_netlink.c
> @@ -600,18 +600,23 @@ static int bond_fill_info(struct sk_buff *skb,
>
> if (BOND_MODE(bond) == BOND_MODE_8023AD) {
> struct ad_info info;
> + u8 zero_mac[ETH_ALEN];
>
> + eth_zero_addr(zero_mac);
> if (nla_put_u16(skb, IFLA_BOND_AD_ACTOR_SYS_PRIO,
> - bond->params.ad_actor_sys_prio))
> + capable(CAP_NET_ADMIN) ?
> + bond->params.ad_actor_sys_prio : 0))
> goto nla_put_failure;
>
> if (nla_put_u16(skb, IFLA_BOND_AD_USER_PORT_KEY,
> - bond->params.ad_user_port_key))
> + capable(CAP_NET_ADMIN) ?
> + bond->params.ad_user_port_key : 0))
> goto nla_put_failure;
>
> if (nla_put(skb, IFLA_BOND_AD_ACTOR_SYSTEM,
> sizeof(bond->params.ad_actor_system),
> - &bond->params.ad_actor_system))
> + capable(CAP_NET_ADMIN) ?
> + &bond->params.ad_actor_system : &zero_mac))
> goto nla_put_failure;
>
Hmm... I would rather not send these fake attributes at all ?
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH next v2] bonding: Display LACP info only to CAP_NET_ADMIN capable user
2015-06-18 11:17 ` Eric Dumazet
@ 2015-06-18 14:41 ` Andy Gospodarek
2015-06-18 17:58 ` Mahesh Bandewar
0 siblings, 1 reply; 4+ messages in thread
From: Andy Gospodarek @ 2015-06-18 14:41 UTC (permalink / raw)
To: Eric Dumazet
Cc: Mahesh Bandewar, Jay Vosburgh, Andy Gospodarek, Veaceslav Falico,
Nikolay Aleksandrov, David Miller, netdev
On Thu, Jun 18, 2015 at 04:17:36AM -0700, Eric Dumazet wrote:
> On Wed, 2015-06-17 at 17:59 -0700, Mahesh Bandewar wrote:
> > Actor and Partner details can be accessed via proc-fs, sys-fs
> > entries or netlink interface. These interfaces are world readable
> > at this moment. The earlier patch-series made the LACP communication
> > secure to avoid nuisance attack from within the same L2 domain but
> > it did not prevent "someone unprivileged" looking at that information
> > on host and perform the same act.
> >
> > This patch essentially avoids spitting those entries if the user
> > in question does not have enough privileges.
> >
> > Signed-off-by: Mahesh Bandewar <maheshb@google.com>
> > ---
> > drivers/net/bonding/bond_netlink.c | 11 ++--
> > drivers/net/bonding/bond_procfs.c | 101 +++++++++++++++++++------------------
> > drivers/net/bonding/bond_sysfs.c | 12 ++---
> > 3 files changed, 67 insertions(+), 57 deletions(-)
> >
> > diff --git a/drivers/net/bonding/bond_netlink.c b/drivers/net/bonding/bond_netlink.c
> > index 5580fcde738f..3fd3aa4b145e 100644
> > --- a/drivers/net/bonding/bond_netlink.c
> > +++ b/drivers/net/bonding/bond_netlink.c
> > @@ -600,18 +600,23 @@ static int bond_fill_info(struct sk_buff *skb,
> >
> > if (BOND_MODE(bond) == BOND_MODE_8023AD) {
> > struct ad_info info;
> > + u8 zero_mac[ETH_ALEN];
> >
> > + eth_zero_addr(zero_mac);
> > if (nla_put_u16(skb, IFLA_BOND_AD_ACTOR_SYS_PRIO,
> > - bond->params.ad_actor_sys_prio))
> > + capable(CAP_NET_ADMIN) ?
> > + bond->params.ad_actor_sys_prio : 0))
> > goto nla_put_failure;
> >
> > if (nla_put_u16(skb, IFLA_BOND_AD_USER_PORT_KEY,
> > - bond->params.ad_user_port_key))
> > + capable(CAP_NET_ADMIN) ?
> > + bond->params.ad_user_port_key : 0))
> > goto nla_put_failure;
> >
> > if (nla_put(skb, IFLA_BOND_AD_ACTOR_SYSTEM,
> > sizeof(bond->params.ad_actor_system),
> > - &bond->params.ad_actor_system))
> > + capable(CAP_NET_ADMIN) ?
> > + &bond->params.ad_actor_system : &zero_mac))
> > goto nla_put_failure;
> >
>
> Hmm... I would rather not send these fake attributes at all ?
That would be my preference as well. Sorry if my lack of elaboration on
on my earlier email made this confusing.
If there are values that should not be visible to non-root users, then
don't send them at all. Do not just send NULL values.
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH next v2] bonding: Display LACP info only to CAP_NET_ADMIN capable user
2015-06-18 14:41 ` Andy Gospodarek
@ 2015-06-18 17:58 ` Mahesh Bandewar
0 siblings, 0 replies; 4+ messages in thread
From: Mahesh Bandewar @ 2015-06-18 17:58 UTC (permalink / raw)
To: Andy Gospodarek
Cc: Eric Dumazet, Jay Vosburgh, Andy Gospodarek, Veaceslav Falico,
Nikolay Aleksandrov, David Miller, netdev
>>
>> Hmm... I would rather not send these fake attributes at all ?
>
> That would be my preference as well. Sorry if my lack of elaboration on
> on my earlier email made this confusing.
>
> If there are values that should not be visible to non-root users, then
> don't send them at all. Do not just send NULL values.
>
OK, would change this in the next rev.
Thanks,
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2015-06-18 17:59 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2015-06-18 0:59 [PATCH next v2] bonding: Display LACP info only to CAP_NET_ADMIN capable user Mahesh Bandewar
2015-06-18 11:17 ` Eric Dumazet
2015-06-18 14:41 ` Andy Gospodarek
2015-06-18 17:58 ` Mahesh Bandewar
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.