2014-07-30 17:25:06

by Debabrata Banerjee

Subject: [PATCH] tcp: don't require root to read tcp_metrics

commit d23ff701643a4a725e2c7a8ba2d567d39daa29ea introduced netlink support for
the new tcp_metrics, however it restricted getting of tcp_metrics to root user
only. This is a change from how these values could have been fetched when in
the old route cache. Unless there's a legitimate reason to restrict the reading
of these values it would be better if normal users could fetch them.

Cc: Julian Anastasov <[email protected]>
Cc: [email protected]
---
net/ipv4/tcp_metrics.c | 1 -
1 file changed, 1 deletion(-)

diff --git a/net/ipv4/tcp_metrics.c b/net/ipv4/tcp_metrics.c
index 4fe0418..0d54e59 100644
--- a/net/ipv4/tcp_metrics.c
+++ b/net/ipv4/tcp_metrics.c
@@ -1093,7 +1093,6 @@ static const struct genl_ops tcp_metrics_nl_ops[] = {
.doit = tcp_metrics_nl_cmd_get,
.dumpit = tcp_metrics_nl_dump,
.policy = tcp_metrics_nl_policy,
- .flags = GENL_ADMIN_PERM,
},
{
.cmd = TCP_METRICS_CMD_DEL,
--
2.0.3

2014-07-30 17:38:29

by Sergei Shtylyov

Subject: Re: [PATCH] tcp: don't require root to read tcp_metrics

Hello.

On 07/30/2014 09:13 PM, Debabrata Banerjee wrote:

> commit d23ff701643a4a725e2c7a8ba2d567d39daa29ea introduced netlink support for

Please also specify that commit's summary line in parens.

> the new tcp_metrics, however it restricted getting of tcp_metrics to root user
> only. This is a change from how these values could have been fetched when in
> the old route cache. Unless there's a legitimate reason to restrict the reading
> of these values it would be better if normal users could fetch them.

> Cc: Julian Anastasov <[email protected]>
> Cc: [email protected]

You need to sign off on the patch, else it couldn't be applied.

WBR, Sergei

2014-07-30 17:50:59

by Debabrata Banerjee

Subject: [PATCH v2] tcp: don't require root to read tcp_metrics

commit d23ff7016 (tcp: add generic netlink support for tcp_metrics) introduced
netlink support for the new tcp_metrics, however it restricted getting of
tcp_metrics to root user only. This is a change from how these values could
have been fetched when in the old route cache. Unless there's a legitimate
reason to restrict the reading of these values it would be better if normal
users could fetch them.

Cc: Julian Anastasov <[email protected]>
Cc: [email protected]

Signed-off-by: Debabrata Banerjee <[email protected]>
---
net/ipv4/tcp_metrics.c | 1 -
1 file changed, 1 deletion(-)

diff --git a/net/ipv4/tcp_metrics.c b/net/ipv4/tcp_metrics.c
index 4fe0418..0d54e59 100644
--- a/net/ipv4/tcp_metrics.c
+++ b/net/ipv4/tcp_metrics.c
@@ -1093,7 +1093,6 @@ static const struct genl_ops tcp_metrics_nl_ops[] = {
.doit = tcp_metrics_nl_cmd_get,
.dumpit = tcp_metrics_nl_dump,
.policy = tcp_metrics_nl_policy,
- .flags = GENL_ADMIN_PERM,
},
{
.cmd = TCP_METRICS_CMD_DEL,
--
2.0.3

2014-07-30 19:34:31

by Julian Anastasov

Subject: Re: [PATCH] tcp: don't require root to read tcp_metrics

Hello,

On Wed, 30 Jul 2014, Debabrata Banerjee wrote:

> commit d23ff701643a4a725e2c7a8ba2d567d39daa29ea introduced netlink support for
> the new tcp_metrics, however it restricted getting of tcp_metrics to root user
> only. This is a change from how these values could have been fetched when in
> the old route cache. Unless there's a legitimate reason to restrict the reading
> of these values it would be better if normal users could fetch them.

Not sure how fatal is to show TCP fastopen cookies to
any user. Otherwise, I don't remember for other restrictions.

Regards

--
Julian Anastasov <[email protected]>

2014-07-30 19:58:43

by Debabrata Banerjee

Subject: Re: [PATCH] tcp: don't require root to read tcp_metrics

Hi,

On 7/30/14, 3:33 PM, "Julian Anastasov" <[email protected]> wrote:
>On Wed, 30 Jul 2014, Debabrata Banerjee wrote:
>
>> commit d23ff701643a4a725e2c7a8ba2d567d39daa29ea introduced netlink
>>support for
>> the new tcp_metrics, however it restricted getting of tcp_metrics to
>>root user
>> only. This is a change from how these values could have been fetched
>>when in
>> the old route cache. Unless there's a legitimate reason to restrict the
>>reading
>> of these values it would be better if normal users could fetch them.
>
> Not sure how fatal is to show TCP fastopen cookies to
>any user. Otherwise, I don't remember for other restrictions.


TFO cookie as reported is sent in the clear in the tcp header. It is not
the secret/key used to generate the cookie, so this should be fine.

-Debabrata

2014-07-31 21:07:53

by David Miller

Subject: Re: [PATCH v2] tcp: don't require root to read tcp_metrics

From: Debabrata Banerjee <[email protected]>
Date: Wed, 30 Jul 2014 13:50:17 -0400

> commit d23ff7016 (tcp: add generic netlink support for tcp_metrics) introduced
> netlink support for the new tcp_metrics, however it restricted getting of
> tcp_metrics to root user only. This is a change from how these values could
> have been fetched when in the old route cache. Unless there's a legitimate
> reason to restrict the reading of these values it would be better if normal
> users could fetch them.
>
> Cc: Julian Anastasov <[email protected]>
> Cc: [email protected]
>
> Signed-off-by: Debabrata Banerjee <[email protected]>

Applied to net-next, thanks.