releases/3.4.83/proc-connector-reject-unprivileged-listener-bumps.patch

   1 From 7c4bf08d3fa22613b628fc967953f581564a13ad Mon Sep 17 00:00:00 2001
   2 From: Kees Cook <keescook@chromium.org>
   3 Date: Mon, 25 Feb 2013 21:32:25 +0000
   4 Subject: proc connector: reject unprivileged listener bumps
   5
   6 From: Kees Cook <keescook@chromium.org>
   7
   8 commit e70ab977991964a5a7ad1182799451d067e62669 upstream.
   9
  10 While PROC_CN_MCAST_LISTEN/IGNORE is entirely advisory, it was possible
  11 for an unprivileged user to turn off notifications for all listeners by
  12 sending PROC_CN_MCAST_IGNORE. Instead, require the same privileges as
  13 required for a multicast bind.
  14
  15 Signed-off-by: Kees Cook <keescook@chromium.org>
  16 Cc: Evgeniy Polyakov <zbr@ioremap.net>
  17 Cc: Matt Helsley <matthltc@us.ibm.com>
  18 Acked-by: Evgeniy Polyakov <zbr@ioremap.net>
  19 Acked-by: Matt Helsley <matthltc@us.ibm.com>
  20 Signed-off-by: David S. Miller <davem@davemloft.net>
  21 [bwh: Backported to 3.2: adjust context]
  22 Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
  23 Cc: Qiang Huang <h.huangqiang@huawei.com>
  24 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  25
  26 ---
  27  drivers/connector/cn_proc.c |    8 ++++++++
  28  1 file changed, 8 insertions(+)
  29
  30 --- a/drivers/connector/cn_proc.c
  31 +++ b/drivers/connector/cn_proc.c
  32 @@ -331,6 +331,12 @@ static void cn_proc_mcast_ctl(struct cn_
  33         if (msg->len != sizeof(*mc_op))
  34                 return;
  35
  36 +       /* Can only change if privileged. */
  37 +       if (!capable(CAP_NET_ADMIN)) {
  38 +               err = EPERM;
  39 +               goto out;
  40 +       }
  41 +
  42         mc_op = (enum proc_cn_mcast_op*)msg->data;
  43         switch (*mc_op) {
  44         case PROC_CN_MCAST_LISTEN:
  45 @@ -343,6 +349,8 @@ static void cn_proc_mcast_ctl(struct cn_
  46                 err = EINVAL;
  47                 break;
  48         }
  49 +
  50 +out:
  51         cn_proc_ack(err, msg->seq, msg->ack);
  52  }
  53