Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
From:   "Liu, Congyu" <liu3101@purdue.edu>
To:     "davem@davemloft.net" <davem@davemloft.net>
CC:     "netdev@vger.kernel.org" <netdev@vger.kernel.org>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
Subject: PROBLEM: potential information leakage in /proc/net/ptype
Thread-Topic: PROBLEM: potential information leakage in /proc/net/ptype
Thread-Index: AQHXPBUz6QTF2lKKc024Iy1Y70EY4g==
Date:   Wed, 28 Apr 2021 10:01:52 +0000
Message-ID: <MWHPR2201MB10722358488A8DA302A988DCD0409@MWHPR2201MB1072.namprd22.prod.outlook.com>
Accept-Language: zh-CN, en-US
Content-Language: zh-CN
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-Network-Message-Id: a8a02d2b-023a-45e2-2e11-08d90a2ca5eb
X-MS-Exchange-CrossTenant-originalarrivaltime: 28 Apr 2021 10:01:52.6488
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 4130bd39-7c53-419c-b1e5-8758d6d63f21
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: E+fy/tBzTyGp2gU/no2maCdGQaWSElJ3KPWH7p623oo8bFWldLO0LLeA12XVkPX71EAv5VgXPnFBUzq/nmMahg==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR2201MB1456
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

Hi,=0A=
=0A=
When a process in network namespace A creates a packet socket without bindi=
ng to any interface, a process in network namespace B can observe the a `pa=
cket_rcv` entry being registered by reading /proc/net/ptype, thus it can in=
fer information about the processes in namespace A.=0A=
=0A=
By looking at the code, it looks like hook function `packet_rcv` is namespa=
ce aware and only works in one net namespace: it only intercepts packets fr=
om the devices inside the network namespace where the packet socket is crea=
ted. However, the `packet_recv` ptype entry can be seen in all namespaces v=
ia /proc/net/ptype. Though minor, this looks like an information leakage.=
=0A=
=0A=
/proc/net/ptype seems to be the root cause: it does not filter those ptype =
entries that do not bind to any interface. But I have also noticed that the=
re were efforts to prevent /proc/net/ptype from leaking net namespace infor=
mation, e.g. commit 2feb27d. So I am wondering if this problem is an inform=
ation leakage bug or deliberate by design? If the latter, what is the reaso=
ning for this?=0A=
=0A=
Thanks for your time and patience!=0A=
=0A=
=0A=
Thanks,=0A=
Congyu Liu=0A=
=0A=
=0A=
Code:=0A=
#define _GNU_SOURCE=0A=
#include <sched.h>=0A=
#include <sys/wait.h>=0A=
#include <stdio.h>=0A=
#include <stdlib.h>=0A=
#include <string.h>=0A=
#include <unistd.h>=0A=
#include <errno.h>=0A=
#include <sys/socket.h>=0A=
#define errExit(msg)=A0=A0=A0 do { perror(msg); exit(EXIT_FAILURE); \=0A=
=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=
=A0=A0 } while (0)=0A=
int main() {=0A=
=A0=A0=A0 char x;=0A=
=A0=A0=A0 int pipe_fd[2];=0A=
=A0=A0=A0 if (pipe(pipe_fd) < 0) {=0A=
=A0=A0=A0=A0=A0=A0=A0 errExit("pipe");=0A=
=A0=A0=A0 }=0A=
=A0=A0=A0 int pid =3D fork();=0A=
=A0=A0=A0 if (pid < 0) {=0A=
=A0=A0=A0=A0=A0=A0=A0 errExit("fork");=0A=
=A0=A0=A0 }=0A=
=A0=A0=A0 if (pid =3D=3D 0) {=0A=
=A0=A0=A0=A0=A0=A0=A0 close(pipe_fd[1]);=0A=
=A0=A0=A0=A0=A0=A0=A0 unshare(CLONE_NEWNET);=0A=
=A0=A0=A0=A0=A0=A0=A0 if (read(pipe_fd[0], &x, 1) < 0) {=0A=
=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0 errExit("read d");=0A=
=A0=A0=A0=A0=A0=A0=A0 }=0A=
=A0=A0=A0=A0=A0=A0=A0 system("cat /proc/net/ptype");=0A=
=A0=A0=A0=A0=A0=A0=A0 return 0;=0A=
=A0=A0=A0 }=0A=
=A0=A0=A0 close(pipe_fd[0]);=0A=
=A0=A0=A0 unshare(CLONE_NEWNET);=0A=
=A0=A0=A0 socket(AF_PACKET, SOCK_RAW, 768);=0A=
=A0=A0=A0 if (write(pipe_fd[1], &x, 1) < 0) {=0A=
=A0=A0=A0=A0=A0=A0=A0 errExit("write");=0A=
=A0=A0=A0 }=0A=
=A0=A0=A0 wait(NULL);=0A=
=A0=A0=A0 return 0;=0A=
}=