• Vasiliy Kulikov's avatar
    net: don't allow CAP_NET_ADMIN to load non-netdev kernel modules · 8909c9ad
    Vasiliy Kulikov authored
    Since a8f80e8f any process with
    CAP_NET_ADMIN may load any module from /lib/modules/.  This doesn't mean
    that CAP_NET_ADMIN is a superset of CAP_SYS_MODULE as modules are
    limited to /lib/modules/**.  However, CAP_NET_ADMIN capability shouldn't
    allow anybody load any module not related to networking.
    
    This patch restricts an ability of autoloading modules to netdev modules
    with explicit aliases.  This fixes CVE-2011-1019.
    
    Arnd Bergmann suggested to leave untouched the old pre-v2.6.32 behavior
    of loading netdev modules by name (without any prefix) for processes
    with CAP_SYS_MODULE to maintain the compatibility with network scripts
    that use autoloading netdev modules by aliases like "eth0", "wlan0".
    
    Currently there are only three users of the feature in the upstream
    kernel: ipip, ip_gre and sit.
    
        root@albatros:~# capsh --drop=$(seq -s, 0 11),$(seq -s, 13 34) --
        root@albatros:~# grep Cap /proc/$$/status
        CapInh:	0000000000000000
        CapPrm:	fffffff800001000
        CapEff:	fffffff800001000
        CapBnd:	fffffff800001000
        root@albatros:~# modprobe xfs
        FATAL: Error inserting xfs
        (/lib/modules/2.6.38-rc6-00001-g2bf4ca3/kernel/fs/xfs/xfs.ko): Operation not permitted
        root@albatros:~# lsmod | grep xfs
        root@albatros:~# ifconfig xfs
        xfs: error fetching interface information: Device not found
        root@albatros:~# lsmod | grep xfs
        root@albatros:~# lsmod | grep sit
        root@albatros:~# ifconfig sit
        sit: error fetching interface information: Device not found
        root@albatros:~# lsmod | grep sit
        root@albatros:~# ifconfig sit0
        sit0      Link encap:IPv6-in-IPv4
    	      NOARP  MTU:1480  Metric:1
    
        root@albatros:~# lsmod | grep sit
        sit                    10457  0
        tunnel4                 2957  1 sit
    
    For CAP_SYS_MODULE module loading is still relaxed:
    
        root@albatros:~# grep Cap /proc/$$/status
        CapInh:	0000000000000000
        CapPrm:	ffffffffffffffff
        CapEff:	ffffffffffffffff
        CapBnd:	ffffffffffffffff
        root@albatros:~# ifconfig xfs
        xfs: error fetching interface information: Device not found
        root@albatros:~# lsmod | grep xfs
        xfs                   745319  0
    
    Reference: https://lkml.org/lkml/2011/2/24/203Signed-off-by: default avatarVasiliy Kulikov <segoon@openwall.com>
    Signed-off-by: default avatarMichael Tokarev <mjt@tls.msk.ru>
    Acked-by: default avatarDavid S. Miller <davem@davemloft.net>
    Acked-by: default avatarKees Cook <kees.cook@canonical.com>
    Signed-off-by: default avatarJames Morris <jmorris@namei.org>
    8909c9ad
ipip.c 22 KB