linux-stable

mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-09-28 05:12:49 +00:00

No description

Find a file

Ido Schimmel 07c8229c02 psample: Require 'CAP_NET_ADMIN' when joining "packets" group [ Upstream commit `44ec98ea5e` ] The "psample" generic netlink family notifies sampled packets over the "packets" multicast group. This is problematic since by default generic netlink allows non-root users to listen to these notifications. Fix by marking the group with the 'GENL_UNS_ADMIN_PERM' flag. This will prevent non-root users or root without the 'CAP_NET_ADMIN' capability (in the user namespace owning the network namespace) from joining the group. Tested using [1]. Before: # capsh -- -c ./psample_repo # capsh --drop=cap_net_admin -- -c ./psample_repo After: # capsh -- -c ./psample_repo # capsh --drop=cap_net_admin -- -c ./psample_repo Failed to join "packets" multicast group [1] $ cat psample.c #include <stdio.h> #include <netlink/genl/ctrl.h> #include <netlink/genl/genl.h> #include <netlink/socket.h> int join_grp(struct nl_sock sk, const char grp_name) { int grp, err; grp = genl_ctrl_resolve_grp(sk, "psample", grp_name); if (grp < 0) { fprintf(stderr, "Failed to resolve \"%s\" multicast group\n", grp_name); return grp; } err = nl_socket_add_memberships(sk, grp, NFNLGRP_NONE); if (err) { fprintf(stderr, "Failed to join \"%s\" multicast group\n", grp_name); return err; } return 0; } int main(int argc, char *argv) { struct nl_sock sk; int err; sk = nl_socket_alloc(); if (!sk) { fprintf(stderr, "Failed to allocate socket\n"); return -1; } err = genl_connect(sk); if (err) { fprintf(stderr, "Failed to connect socket\n"); return err; } err = join_grp(sk, "config"); if (err) return err; err = join_grp(sk, "packets"); if (err) return err; return 0; } $ gcc -I/usr/include/libnl3 -lnl-3 -lnl-genl-3 -o psample_repo psample.c Fixes: `6ae0a62861` ("net: Introduce psample, a new genetlink channel for packet sampling") Reported-by: "The UK's National Cyber Security Centre (NCSC)" <security@ncsc.gov.uk> Signed-off-by: Ido Schimmel <idosch@nvidia.com> Reviewed-by: Jacob Keller <jacob.e.keller@intel.com> Reviewed-by: Jiri Pirko <jiri@nvidia.com> Link: https://lore.kernel.org/r/20231206213102.1824398-2-idosch@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>		2023-12-13 18:39:11 +01:00
arch	x86/tdx: Allow 32-bit emulation by default	2023-12-13 18:39:05 +01:00
block	blk-core: use pr_warn_ratelimited() in bio_check_ro()	2023-11-20 11:52:17 +01:00
certs	certs: Fix build error when PKCS#11 URI contains semicolon	2023-02-09 11:28:11 +01:00
crypto	crypto: pcrypt - Fix hungtask for PADATA_RESET	2023-11-28 17:06:58 +00:00
Documentation	dt-bindings: interrupt-controller: Allow #power-domain-cells	2023-12-13 18:39:10 +01:00
drivers	octeontx2-af: Update Tx link register range	2023-12-13 18:39:10 +01:00
fs	iomap: update ki_pos a little later in iomap_dio_complete	2023-12-08 08:51:20 +01:00
include	netfilter: nft_exthdr: add boolean DCCP option matching	2023-12-13 18:39:10 +01:00
init	proc: sysctl: prevent aliased sysctls from getting passed to init	2023-11-28 17:07:08 +00:00
io_uring	io_uring: fix off-by one bvec index	2023-12-03 07:32:13 +01:00
ipc	ipc: fix memory leak in init_mqueue_fs()	2022-12-31 13:32:01 +01:00
kernel	hrtimers: Push pending hrtimers away from outgoing CPU earlier	2023-12-13 18:39:03 +01:00
lib	zstd: Fix array-index-out-of-bounds UBSAN warning	2023-12-13 18:39:04 +01:00
LICENSES	LICENSES/LGPL-2.1: Add LGPL-2.1-or-later as valid identifiers	2021-12-16 14:33:10 +01:00
mm	mm,kfence: decouple kfence from page granularity mapping judgement	2023-12-03 07:32:08 +01:00
net	psample: Require 'CAP_NET_ADMIN' when joining "packets" group	2023-12-13 18:39:11 +01:00
rust	rust: allocator: Prevent mis-aligned allocation	2023-08-11 12:08:18 +02:00
samples	fprobe: Pass entry_data to handlers	2023-10-25 12:03:12 +02:00
scripts	dt: dt-extract-compatibles: Don't follow symlinks when walking tree	2023-12-13 18:39:05 +01:00
security	ima: detect changes to the backing overlay file	2023-11-28 17:07:12 +00:00
sound	ALSA: hda/realtek: Add supported ALC257 for ChromeOS	2023-12-08 08:51:13 +01:00
tools	selftests/net: mptcp: fix uninitialized variable warnings	2023-12-08 08:51:17 +01:00
usr	usr/gen_init_cpio.c: remove unnecessary -1 values from int file	2022-10-03 14:21:44 -07:00
virt	kvm/vfio: ensure kvg instance stays around in kvm_vfio_group_add()	2023-09-13 09:42:46 +02:00
.clang-format	inet: ping: use hlist_nulls rcu iterator during lookup	2022-12-01 12:42:46 +01:00
.cocciconfig
.get_maintainer.ignore	get_maintainer: add Alan to .get_maintainer.ignore	2022-08-20 15:17:44 -07:00
.gitattributes
.gitignore	Kbuild: add Rust support	2022-09-28 09:02:20 +02:00
.mailmap	9 hotfixes. 6 for MM, 3 for other areas. Four of these patches address	2022-12-10 17:10:52 -08:00
.rustfmt.toml	rust: add `.rustfmt.toml`	2022-09-28 09:02:20 +02:00
COPYING
CREDITS	MAINTAINERS: Remove Michal Marek from Kbuild maintainers	2022-11-16 14:53:00 +09:00
Kbuild	Kbuild updates for v6.1	2022-10-10 12:00:45 -07:00
Kconfig
MAINTAINERS	devlink: move code to a dedicated directory	2023-08-30 16:11:00 +02:00
Makefile	Linux 6.1.67	2023-12-11 10:41:01 +01:00
README

README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.