Subject: Re: [PATCH] net:ppp: replace too strict capability restriction on opening /dev/ppp

From: Andi Kleen <[email-masked]>
Date: Sun, 19 Jun 2016 22:02:02 -0700

Shanker Wang <[email-masked]> writes:

> This patch removes the check for CAP_NET_ADMIN in the initial namespace
> when opening /dev/open. Instead, CAP_NET_ADMIN is checked in the user
> namespace the net namespace was created so that /dev/ppp cat get opened
> in a unprivileged container.

Seems dangerous. From a quick look at the PPP ioctl there is no limit
how many PPP devices this can create. So a container having access to
this would be able to fill all kernel memory. Probably needs more
auditing and hardening first.

In general there seems to be a lot of attack surface for root
in PPP.

-Andi

-- 
[email-masked] -- Speaking for myself only