Doug / smarc-fsl-linux-kernel

Download as
Browse Code ยป

Commit e70ab977991964a5a7ad1182799451d067e62669

Authored by Kees Cook
Committed by David S. Miller
1 parent 114a6f8b52
Exists in smarc-l5.0.0_1.0.0-ga and in 5 other branches imx_3.10.17_1.0.1_ga, imx_3.10.53_1.1.0_ga, imx_3.14.28_1.0.0_ga, smarc-imx_3.10.53_1.1.0_ga, smarc-imx_3.14.28_1.0.0_ga

proc connector: reject unprivileged listener bumps 

While PROC_CN_MCAST_LISTEN/IGNORE is entirely advisory, it was possible
for an unprivileged user to turn off notifications for all listeners by
sending PROC_CN_MCAST_IGNORE. Instead, require the same privileges as
required for a multicast bind.

Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: Evgeniy Polyakov <zbr@ioremap.net>
Cc: Matt Helsley <matthltc@us.ibm.com>
Cc: stable@vger.kernel.org
Acked-by: Evgeniy Polyakov <zbr@ioremap.net>
Acked-by: Matt Helsley <matthltc@us.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Showing 1 changed file with 8 additions and 0 deletions Side-by-side Diff

drivers/connector/cn_proc.c
Diff comments   View file @ e70ab97
... ... @@ -313,6 +313,12 @@
313 313 (task_active_pid_ns(current) != &init_pid_ns))
314 314 return;
315 315  
  316 + /* Can only change if privileged. */
  317 + if (!capable(CAP_NET_ADMIN)) {
  318 + err = EPERM;
  319 + goto out;
  320 + }
  321 +
316 322 mc_op = (enum proc_cn_mcast_op *)msg->data;
317 323 switch (*mc_op) {
318 324 case PROC_CN_MCAST_LISTEN:
... ... @@ -325,6 +331,8 @@
325 331 err = EINVAL;
326 332 break;
327 333 }
  334 +
  335 +out:
328 336 cn_proc_ack(err, msg->seq, msg->ack);
329 337 }
330 338