The "skip the send permission check in repair mode" logic was mis-parenthesised:
if ((dst_group || dst_portid) &&
!netlink_allowed(sock, NL_CFG_F_NONROOT_SEND &&
!repair))
goto out;
"&& !repair" was folded into the second argument of netlink_allowed().
Because NL_CFG_F_NONROOT_SEND == (1 << 1) == 2, the expression
"NL_CFG_F_NONROOT_SEND && !repair" evaluates to the int 1 (in non-repair
mode), not 2, so netlink_allowed() tested the NL_CFG_F_NONROOT_RECV bit
(1 << 0) instead of NL_CFG_F_NONROOT_SEND. For a protocol configured with
NONROOT_SEND only (e.g. NETLINK_USERSOCK), flags & NONROOT_RECV == 0, so an
unprivileged multicast/unicast sendmsg started requiring CAP_NET_ADMIN and
failed with -EPERM - a permission regression - while in repair mode the
check was not actually bypassed as intended.
Move "&& !repair" out of the netlink_allowed() argument so the check is the
intended: deny only when the socket is not allowed to send AND we are not in
repair mode.
Fixes: cec8e3bfc365 ("netlink: add an ability to restore messages in a receive
queue")
https://virtuozzo.atlassian.net/browse/VSTOR-132310
Signed-off-by: Konstantin Khorenko <[email protected]>
---
net/netlink/af_netlink.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 5a065e6cedcb..f686e6ea30ce 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -1901,8 +1901,8 @@ static int netlink_sendmsg(struct socket *sock, struct
msghdr *msg, size_t len)
dst_group = ffs(addr->nl_groups);
err = -EPERM;
if ((dst_group || dst_portid) &&
- !netlink_allowed(sock, NL_CFG_F_NONROOT_SEND &&
- !repair))
+ !netlink_allowed(sock, NL_CFG_F_NONROOT_SEND) &&
+ !repair)
goto out;
netlink_skb_flags |= NETLINK_SKB_DST;
} else {
--
2.47.1
_______________________________________________
Devel mailing list
[email protected]
https://lists.openvz.org/mailman/listinfo/devel
