On Mon, Jul 27, 2020 at 11:29:36AM -0500, Eric W. Biederman wrote:
> Alexey Gladkov <[email protected]> writes:
>
> > Show /proc/self/net only for CAP_NET_ADMIN if procfs is mounted with
> > subset=pid option in user namespace. This is done to avoid possible
> > information leakage.
> >
> > Signed-off-by: Alexey Gladkov <[email protected]>
> > ---
> > fs/proc/proc_net.c | 6 ++++++
> > 1 file changed, 6 insertions(+)
> >
> > diff --git a/fs/proc/proc_net.c b/fs/proc/proc_net.c
> > index dba63b2429f0..11fa2c4b3529 100644
> > --- a/fs/proc/proc_net.c
> > +++ b/fs/proc/proc_net.c
> > @@ -275,6 +275,12 @@ static struct net *get_proc_task_net(struct inode *dir)
> > struct task_struct *task;
> > struct nsproxy *ns;
> > struct net *net = NULL;
> > + struct proc_fs_info *fs_info = proc_sb_info(dir->i_sb);
> > +
> > + if ((fs_info->pidonly == PROC_PIDONLY_ON) &&
> > + (current_user_ns() != &init_user_ns) &&
> > + !capable(CAP_NET_ADMIN))
> > + return net;
> >
> > rcu_read_lock();
> > task = pid_task(proc_pid(dir), PIDTYPE_PID);
>
> Hmm.
>
> I see 3 options going forward.
>
> 1) We just make PROC_PIDONLY_ON mean the net directory does not exist.
> No permission checks just always fail.
I think it's wrong. Now if someone mounts a fully visible procfs then they
can see this directory. Hiding this directory completely will change the
current behavior.
> 2) Move the permission checks into opendir/readdir and whichever
> is the appropriate method there and always allow the dentries
> to be cached.
At first I did so, but then I transferred this check to get_proc_task_net
because if this function does not return anything, then 'net' directory
will exist but will simply be empty.
This allowed us to get rid of unnecessary wrappers for opendir/lookup.
> 3) Simply cache the mounters credentials and make access to the
> net directories contingent of the permisions of the mounter of
> proc. Something like the code below.
Interesting idea. I like that :)
> static struct net *get_proc_task_net(struct inode *dir)
> {
> struct task_struct *task;
> struct nsproxy *ns;
> struct net *net = NULL;
>
> rcu_read_lock();
> task = pid_task(proc_pid(dir), PIDTYPE_PID);
> if (task != NULL) {
> task_lock(task);
> ns = task->nsproxy;
> if (ns != NULL)
> net = get_net(ns->net_ns);
> task_unlock(task);
> }
> rcu_read_unlock();
> if ((fs_info->pidonly == PROC_PIDONLY_ON) &&
Is this check necessary? I mean, isn't it worth extending this check to
other cases?
> !security_capable(fs_info->mounter_cred,
> net->user_ns, CAP_SYS_ADMIN,
> CAP_OPT_NONE)) {
> put_net(net);
> net = NULL;
> }
> return net;
> }
>
> Eric
>
--
Rgrds, legion
