netns: avoid directory traversal

ip netns keeps track of created namespaces with bind mounts named
/var/run/netns/<namespace>. No input sanitization is done, allowing creation and
deletion of files relatives to /var/run/netns or, if the path is non existent or
invalid, allows to create "untracked" namespaces (invisible to the tool).

This commit denies creation or deletion of namespaces with names contaning
"/" or matching exactly "." or "..".

Signed-off-by: Matteo Croce <mcroce@redhat.com>

diff --git a/ip/ipnetns.c b/ip/ipnetns.c
index 0b0378ab6560c6152f17909a2eea95127f2f02c8..4254994442ccdfb57fab3dcd769cb795fbdcc88f 100644 (file)
--- a/ip/ipnetns.c
+++ b/ip/ipnetns.c
@@ -766,6 +766,11 @@ static int netns_monitor(int argc, char **argv)
        return 0;
 }
 
+static int invalid_name(const char *name)
+{
+       return strchr(name, '/') || !strcmp(name, ".") || !strcmp(name, "..");
+}
+
 int do_netns(int argc, char **argv)
 {
        netns_nsid_socket_init();
@@ -775,6 +780,11 @@ int do_netns(int argc, char **argv)
                return netns_list(0, NULL);
        }
 
+       if (argc > 1 && invalid_name(argv[1])) {
+               fprintf(stderr, "Invalid netns name \"%s\"\n", argv[1]);
+               exit(-1);
+       }
+
        if ((matches(*argv, "list") == 0) || (matches(*argv, "show") == 0) ||
            (matches(*argv, "lst") == 0)) {
                netns_map_init();