OpenE2K
/
linux
6
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
linux/net/sched
History
Eric W. Biederman be0ef855ba net: Use netlink_ns_capable to verify the permisions of netlink messages 
[ Upstream commit 90f62cf30a ]

It is possible by passing a netlink socket to a more privileged
executable and then to fool that executable into writing to the socket
data that happens to be valid netlink message to do something that
privileged executable did not intend to do.

To keep this from happening replace bare capable and ns_capable calls
with netlink_capable, netlink_net_calls and netlink_ns_capable calls.
Which act the same as the previous calls except they verify that the
opener of the socket had the desired permissions as well.

Reported-by: Andy Lutomirski <luto@amacapital.net>
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 		2014-06-26 15:15:38 -04:00
..
Kconfig net: pkt_sched: PIE AQM scheme 2014-01-06 15:13:01 -05:00
Makefile net: pkt_sched: PIE AQM scheme 2014-01-06 15:13:01 -05:00
act_api.c net: Use netlink_ns_capable to verify the permisions of netlink messages 2014-06-26 15:15:38 -04:00
act_csum.c net_sched: act: fetch hinfo from a->ops->hinfo 2014-01-21 14:43:16 -08:00
act_gact.c net_sched: act: fetch hinfo from a->ops->hinfo 2014-01-21 14:43:16 -08:00
act_ipt.c net_sched: act: fetch hinfo from a->ops->hinfo 2014-01-21 14:43:16 -08:00
act_mirred.c net_sched: act: fetch hinfo from a->ops->hinfo 2014-01-21 14:43:16 -08:00
act_nat.c net_sched: act: fetch hinfo from a->ops->hinfo 2014-01-21 14:43:16 -08:00
act_pedit.c net_sched: act: fetch hinfo from a->ops->hinfo 2014-01-21 14:43:16 -08:00
act_police.c net_sched: act: export tcf_hash_search() instead of tcf_hash_lookup() 2014-01-21 14:43:16 -08:00
act_simple.c net_sched: act: fetch hinfo from a->ops->hinfo 2014-01-21 14:43:16 -08:00
act_skbedit.c net_sched: act: fetch hinfo from a->ops->hinfo 2014-01-21 14:43:16 -08:00
cls_api.c net: Use netlink_ns_capable to verify the permisions of netlink messages 2014-06-26 15:15:38 -04:00
cls_basic.c net_sched: avoid casting void pointer 2014-01-13 11:50:15 -08:00
cls_bpf.c net_sched: add struct net pointer to tcf_proto_ops->dump 2014-01-13 11:50:14 -08:00
cls_cgroup.c net_sched: add struct net pointer to tcf_proto_ops->dump 2014-01-13 11:50:14 -08:00
cls_flow.c net_sched: add struct net pointer to tcf_proto_ops->dump 2014-01-13 11:50:14 -08:00
cls_fw.c net_sched: fix error return code in fw_change_attrs() 2014-01-16 19:12:03 -08:00
cls_route.c net_sched: avoid casting void pointer 2014-01-13 11:50:15 -08:00
cls_rsvp.c
…
cls_rsvp.h net_sched: add struct net pointer to tcf_proto_ops->dump 2014-01-13 11:50:14 -08:00
cls_rsvp6.c
…
cls_tcindex.c net_sched: fix an oops in tcindex filter 2014-05-31 13:20:39 -07:00
cls_u32.c net_sched: avoid casting void pointer 2014-01-13 11:50:15 -08:00
em_canid.c
…
em_cmp.c
…
em_ipset.c
…
em_meta.c net: Change skb_get_rxhash to skb_get_hash 2013-12-17 16:36:21 -05:00
em_nbyte.c
…
em_text.c
…
em_u32.c
…
ematch.c
…
sch_api.c net: Use netlink_ns_capable to verify the permisions of netlink messages 2014-06-26 15:15:38 -04:00
sch_atm.c
…
sch_blackhole.c
…
sch_cbq.c net_sched: replace pr_warning with pr_warn 2013-12-31 13:50:56 -05:00
sch_choke.c random32: add prandom_u32_max and convert open coded users 2014-01-21 23:17:20 -08:00
sch_codel.c
…
sch_drr.c
…
sch_dsmark.c sch_dsmark: use correct func name in print messages 2013-12-31 13:50:57 -05:00
sch_fifo.c
…
sch_fq.c pkt_sched: fq: do not hold qdisc lock while allocating memory 2014-03-10 16:17:52 -04:00
sch_fq_codel.c net: replace macros net_random and net_srandom with direct calls to prandom 2014-01-14 15:15:25 -08:00
sch_generic.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2014-01-14 14:42:42 -08:00
sch_gred.c net_sched: replace pr_warning with pr_warn 2013-12-31 13:50:56 -05:00
sch_hfsc.c
…
sch_hhf.c net: sched: lock imbalance in hhf qdisc 2014-05-31 13:20:36 -07:00
sch_htb.c sch_htb: let skb->priority refer to non-leaf class 2014-01-22 17:39:48 -08:00
sch_ingress.c
…
sch_mq.c pkt_sched: give visibility to mq slave qdiscs 2013-12-09 19:54:47 -05:00
sch_mqprio.c pkt_sched: give visibility to mq slave qdiscs 2013-12-09 19:54:47 -05:00
sch_multiq.c net/*: Fix FSF address in file headers 2013-12-06 12:37:57 -05:00
sch_netem.c reciprocal_divide: update/correction of the algorithm 2014-01-21 23:17:20 -08:00
sch_pie.c net: sched: Cleanup PIE comments 2014-02-13 18:29:58 -05:00
sch_plug.c
…
sch_prio.c
…
sch_qfq.c
…
sch_red.c
…
sch_sfb.c net: replace macros net_random and net_srandom with direct calls to prandom 2014-01-14 15:15:25 -08:00
sch_sfq.c net: replace macros net_random and net_srandom with direct calls to prandom 2014-01-14 15:15:25 -08:00
sch_tbf.c sch_tbf: Fix potential memory leak in tbf_change(). 2014-02-27 12:53:50 -05:00
sch_teql.c
…