From: ebiederm@xmission•com (Eric W. Biederman)
To: Jiri Benc <jbenc@redhat•com>
Cc: Andy Lutomirski <luto@amacapital•net>,
Linus Torvalds <torvalds@linux-foundation•org>,
David Miller <davem@davemloft•net>,
"Jorge Boncompte \[DTI2\]" <jorge@dti2•net>,
Vivek Goyal <vgoyal@redhat•com>, Simo Sorce <ssorce@redhat•com>,
"security\@kernel.org" <security@kernel•org>,
Network Development <netdev@vger•kernel.org>,
"Serge E. Hallyn" <serge@hallyn•com>
Subject: Re: [PATCH 5/5] net: Use netlink_ns_capable to verify the permisions of netlink messages
Date: Fri, 23 May 2014 16:25:09 -0700 [thread overview]
Message-ID: <87ioow6pt6.fsf@x220.int.ebiederm.org> (raw)
In-Reply-To: <20140522170505.64ef87a2@griffin> (Jiri Benc's message of "Thu, 22 May 2014 17:05:05 +0200")
Jiri Benc <jbenc@redhat•com> writes:
> On Wed, 7 May 2014 16:45:10 -0700, Andy Lutomirski wrote:
>> It looks like Zebra is mucking with its effective set. It creates the
>> socket w/o effective caps, raises them to bind (no clue why), lowers
>> them post-bind, then raises them again to sendto. Presumably the new
>> checks cause the sendto to fail b/c the socket()-time credentials were
>> insufficient.
>>
>> I don't see why it bound w/ elevated permissions, since I don't think
>> this is important. And it never connected at all.
>>
>> Hence my suggestion that we check permissions at connect time instead
>> of socket() time and that we just check send-time permissions on an
>> unconnected socket. Yes, this is awful.
>
> AFAIK this is still unresolved and this seems to be the only solution
> proposed so far that fixes the security problem and does not break
> zebra. Or have I missed something and the conclusion is zebra needs to
> be modified to comply with the changed semantics?
I have not seen consensus that what Zebra is doing makes sense to
support.
What Zebra is doing (opening a socket without privilege and then sending
privileged messages over that socket) smells. This is effecting
performing trusted operations over an untrusted channel.
I can not see why that would ever be a desirable application
architecture.
There is also historical precedent for what the kernel is doing as it is
effectively checking SO_PEERCRED.
Furthermore I have not seen even a bad implementation of a way to
remember who called connect, and the possibility of needing different
permission checks for send vs sendto makes any implementation I can
think of nasty and ugly. Which generally translates into complicated
and not secure.
So short of someone having a better idea it looks like Zebra is broken
until it is patched to open sockets with privilege when Zerbra is going
to send privileged messages over those sockets.
Eric
next prev parent reply other threads:[~2014-05-23 23:26 UTC|newest]
Thread overview: 46+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <CALCETrUaYhh6Dkzn0TMEUz-GEO9-6ObByk5d_xRViSMBbp5Pkg@mail.gmail.com>
[not found] ` <cover.1397840611.git.luto@amacapital.net>
[not found] ` <6daf425e2023266d52d181e4d2ee18747d4f1fa8.1397840611.git.luto@amacapital.net>
[not found] ` <87tx9nuxf6.fsf@x220.int.ebiederm.org>
[not found] ` <CALCETrUqNVRBse4rUeUKfgYt0d+9x1JrEHGcZ_DnWyq7W6Yyzw@mail.gmail.com>
[not found] ` <87r44qtabz.fsf@x220.int.ebiederm.org>
[not found] ` <CALCETrWzUQ7QjykT85ExDfX-+9eDD-D-dcxofUMPvLK=ia9arg@mail.gmail.com>
[not found] ` <87r44qrt8v.fsf_-_@x220.int.ebiederm.org>
2014-04-22 21:13 ` [PATCH 0/6]: Preventing abuse when passing file descriptors Eric W. Biederman
2014-04-22 21:14 ` [PATCH 1/6] netlink: Rename netlink_capable netlink_allowed Eric W. Biederman
2014-04-22 21:15 ` [PATCH 2/6] net: Move the permission check in sock_diag_put_filterinfo to packet_diag_dump Eric W. Biederman
2014-04-22 21:15 ` [PATCH 3/6] net: Fix ns_capable check in packet_diag_dump Eric W. Biederman
2014-04-22 21:16 ` [PATCH 4/6] net: Add variants of capable for use on on sockets Eric W. Biederman
2014-04-22 21:16 ` [PATCH 5/6] net: Add variants of capable for use on netlink messages Eric W. Biederman
2014-04-22 21:17 ` [PATCH 6/6] net: Use netlink_ns_capable to verify the permisions of " Eric W. Biederman
2014-04-23 19:32 ` [PATCH 0/6]: Preventing abuse when passing file descriptors David Miller
2014-04-23 21:24 ` [PATCH 0/5]: " Eric W. Biederman
2014-04-23 21:25 ` [PATCH 1/5] netlink: Rename netlink_capable netlink_allowed Eric W. Biederman
2014-04-23 21:26 ` [PATCH 2/5] net: Move the permission check in sock_diag_put_filterinfo to packet_diag_dump Eric W. Biederman
2014-04-23 21:26 ` [PATCH 3/5] net: Add variants of capable for use on on sockets Eric W. Biederman
2014-04-23 21:28 ` [PATCH 4/5] net: Add variants of capable for use on netlink messages Eric W. Biederman
2014-04-23 21:29 ` [PATCH 5/5] net: Use netlink_ns_capable to verify the permisions of " Eric W. Biederman
2014-05-07 22:18 ` Jorge Boncompte [DTI2]
2014-05-07 22:26 ` Andy Lutomirski
2014-05-07 22:52 ` David Miller
2014-05-07 23:01 ` Andy Lutomirski
2014-05-07 23:34 ` Linus Torvalds
2014-05-07 23:45 ` Andy Lutomirski
2014-05-22 15:05 ` Jiri Benc
2014-05-23 23:25 ` Eric W. Biederman [this message]
2014-05-23 23:51 ` Linus Torvalds
2014-05-24 22:34 ` David Miller
2014-05-25 5:38 ` [RFC][PATCH] netlink: Only check file credentials for implicit destinations Eric W. Biederman
2014-05-25 16:50 ` Andy Lutomirski
2014-05-25 23:44 ` Eric W. Biederman
2014-05-26 0:32 ` Linus Torvalds
2014-05-26 5:36 ` [RFC][PATCH 2/1] netlink: Use the credential at the time the destination address was set Eric W. Biederman
2014-05-26 17:19 ` Andy Lutomirski
2014-05-27 4:24 ` Eric W. Biederman
2014-05-26 13:39 ` [RFC][PATCH] netlink: Only check file credentials for implicit destinations Willy Tarreau
2014-05-26 8:38 ` Michael Kerrisk (man-pages)
2014-05-25 5:45 ` [PATCH 5/5] net: Use netlink_ns_capable to verify the permisions of netlink messages Eric W. Biederman
2014-05-25 16:27 ` Andy Lutomirski
2014-05-08 21:29 ` Stephen Hemminger
2014-05-08 21:32 ` Andy Lutomirski
[not found] ` <CA+55aFzOHZcw2o6Cq6rSddSBDZvhgzYToBruak9SLCHxx-fA3Q@mail.gmail.com>
2014-05-08 21:49 ` Andy Lutomirski
2014-05-08 22:07 ` Stephen Hemminger
2014-05-08 21:54 ` David Miller
2014-05-07 23:45 ` David Miller
2014-05-08 21:21 ` Stephen Hemminger
2014-05-08 21:52 ` David Miller
2014-05-08 21:54 ` Andy Lutomirski
2014-04-24 17:45 ` [PATCH 0/5]: Preventing abuse when passing file descriptors David Miller
2014-06-13 1:31 [PATCH 0/5] Backport to 3.10.y for fix CVE-2014-0181 Xiangyu Lu
2014-06-13 1:31 ` [PATCH 5/5] net: Use netlink_ns_capable to verify the permisions of netlink messages Xiangyu Lu
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87ioow6pt6.fsf@x220.int.ebiederm.org \
--to=ebiederm@xmission$(echo .)com \
--cc=davem@davemloft$(echo .)net \
--cc=jbenc@redhat$(echo .)com \
--cc=jorge@dti2$(echo .)net \
--cc=luto@amacapital$(echo .)net \
--cc=netdev@vger$(echo .)kernel.org \
--cc=security@kernel$(echo .)org \
--cc=serge@hallyn$(echo .)com \
--cc=ssorce@redhat$(echo .)com \
--cc=torvalds@linux-foundation$(echo .)org \
--cc=vgoyal@redhat$(echo .)com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox