Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Anjali Kulkarni <anjali.k.kulkarni@oracle.com>
To:     Liam Howlett <liam.howlett@oracle.com>
CC:     "davem@davemloft.net" <davem@davemloft.net>,
        "david@fries.net" <david@fries.net>,
        Eric Dumazet <edumazet@google.com>,
        Jakub Kicinski <kuba@kernel.org>,
        "pabeni@redhat.com" <pabeni@redhat.com>,
        Evgeniy Polyakov <zbr@ioremap.net>,
        Christian Brauner <brauner@kernel.org>,
        "johannes@sipsolutions.net" <johannes@sipsolutions.net>,
        "ecree.xilinx@gmail.com" <ecree.xilinx@gmail.com>,
        "leon@kernel.org" <leon@kernel.org>,
        "keescook@chromium.org" <keescook@chromium.org>,
        "socketcan@hartkopp.net" <socketcan@hartkopp.net>,
        "petrm@nvidia.com" <petrm@nvidia.com>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        "netdev@vger.kernel.org" <netdev@vger.kernel.org>
Subject: Re: [PATCH v7 5/6] connector/cn_proc: Allow non-root users access
Thread-Topic: [PATCH v7 5/6] connector/cn_proc: Allow non-root users access
Thread-Index: AQHZrgwd5Uh3sQesl0S5mkJB0BWZKK+tMUQAgAAMagA=
Date:   Thu, 6 Jul 2023 21:00:27 +0000
Message-ID: <2B585919-6017-4496-B001-F6CEE8F35470@oracle.com>
References: <20230704001136.2301645-1-anjali.k.kulkarni@oracle.com>
 <20230704001136.2301645-6-anjali.k.kulkarni@oracle.com>
 <20230706201600.kkgf7urekwt4y7r3@revolver>
In-Reply-To: <20230706201600.kkgf7urekwt4y7r3@revolver>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?MrwD1Pe/yMbkupkrJPVsXzx597uJlI/V6OX+bkxQBVupGNHCVWT4CQi/y1Ro?=
 =?us-ascii?Q?b+gTWmFRQ152htYnU8YaGnWjwOiMXWqu7M7mvgWjUyRsJ1hJTuXrXIgcbwlg?=
 =?us-ascii?Q?sLmz15WrhE6HKBGfQjN4fFErdkstb69lCUjEgDge5fwe5M2NTFK9d0jarTxR?=
 =?us-ascii?Q?sVniPLHxKf9OnQQcqWE9h1wDS3Dtrz3LlCSgvo6g2SWJtm2hj4SbTI9i7vuv?=
 =?us-ascii?Q?PkycyvQzVV/Pnq8PsCG+9vEyZDnK5ZBoNal+SnNCw5ndNfj1pv0oSm2bUdba?=
 =?us-ascii?Q?9X0Z53nRAN7hCEzx71YC6KzFEXQTkzna6oS4fQX/UGkZApbH5io7rD+ZTCjh?=
 =?us-ascii?Q?VqzipovXoemUbkqARx5lO6h9+o0vwj5mQck2Sd1Yfdkji48ifgajtq3RwQDk?=
 =?us-ascii?Q?F4sK7e8gmteHONMHDqfBVnYJM5vf0shhzyXWyu8cm1ctWJ8FV006s6IJvOmL?=
 =?us-ascii?Q?BnIqbE5+uxJbWb/5mw+KpCMDsJDgn7Lnvda+JN1149cJ9NpWutawojvSJEVl?=
 =?us-ascii?Q?bdGRuGTSHORg0vPy5UeknStEo7mFDGhdSk0umTfa+jSGr5nzFhmPCDPWkKF1?=
 =?us-ascii?Q?W1ew0afQWXS3EzmMx93MQMDjsMkYLsjoJf6FizexAvTeLzDi36pWPjmUiQiX?=
 =?us-ascii?Q?tNQwOiZCofhcWYXdFASgv6DQ46DOdXlGCqWdrhcuJSLGcAf/hFc3S7N+06C8?=
 =?us-ascii?Q?PeGOcthB+xD2ZyqOZcnUFQFu/TRO0sYegimP4sCuGc+s2YJ7Or2fDA2Nz+OX?=
 =?us-ascii?Q?MqtEr/VWEBv6hOoqrzWC4PEuSWAUcNVzhGAdurrpoKLEqnnkZjOf+NO4Pw26?=
 =?us-ascii?Q?TbUByeJ3G3Po4FWgRAZnj25RgO1Facco5Z3BIU57Gi8FbsdRZ6w8ltdtGQQ2?=
 =?us-ascii?Q?wsmRUJO8wuW/RG5koq9kBzvTPTMnpSumGSK2+sbWE1UC1IacuQ2Qj37lN0jO?=
 =?us-ascii?Q?V8sJWV+Q20Kp3PS2jXXdd1GwA3beGEhAATdHlv/tu82a6sqarT3RCi9ptj3r?=
 =?us-ascii?Q?I5tUKvbbm85hdgi9UN6GpNiNGhj2bzWSF02ko6TovOgw/neBNyCfkhaCC2Kc?=
 =?us-ascii?Q?6TAwuHIURtyMqbJU8OpggrFW2MPgx2ZbzEqV4H9Te5rSbYCMaD+WVDGkMseE?=
 =?us-ascii?Q?xVnH9UExoYW/PoW/K+JRWZf8nsNqDiGue5qtKR4DyAH0aGo2ulnuajnd3tX+?=
 =?us-ascii?Q?85EdyEEWOGj+/Q9TLaqC+jQ2GTyQ+GY+GEJEBPdVmzJTminIzF+uffIAXszF?=
 =?us-ascii?Q?7A93llSq847arj9tymWQzxHH4tQjAkBhj7KsFmLIoW24d8j55IH1zbWjNCZj?=
 =?us-ascii?Q?V/77kajUD4PrgifBvBlvLCicN0gU/bRXUywPvq7y+r9zN0m5N9FOKfYUsf3t?=
 =?us-ascii?Q?+GvFlYU6IRMDcd/WgL9XS8uQ90p+CYpUNG7iiRaVY1ev+3OoTJEpSp8qdDV7?=
 =?us-ascii?Q?sKtdHmb4VZoJcrqyEYVe1s1rIeNOvFlray+hJJ7P2GiVGSAkccMHHBR959ZJ?=
 =?us-ascii?Q?hiTsc1KyoZWNP75nQWxcfbpcmpWD9c/8L43BMlUxyC4G4pkwn6pmlnZ8symT?=
 =?us-ascii?Q?3qcjjcG7thpgXA5BMzqlT6peCu5RcXilGzGsG0akhLoyNzbI7Sm4u0fUGW/l?=
 =?us-ascii?Q?DA=3D=3D?=
Content-Type: text/plain; charset="us-ascii"
Content-ID: <4C3364B44EA5AF4DA7A049C1E87F8D08@namprd10.prod.outlook.com>
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-0: =?us-ascii?Q?nobw5+rtlMHxoHBy2COg4qzJKgX1Qhz4rTZc0F7vSZBQdNOEpuh2pJbOenqw?=
 =?us-ascii?Q?bLcD4w75x0yU3FeeuVfi2PLaY02bHwzjG/mX7pCOh1PX2T5khTQzYM+Zo71f?=
 =?us-ascii?Q?SxPmrKuQhUPoMNBy98hmFANOdk1GfGizX+JKUf/vBnUCIRDAhAV7xpscO0bA?=
 =?us-ascii?Q?q8JOYMuyqZrN98t0RGukkCbN+QtP4XOhhRXJYXNDvl3OstJATqy44/CTYVsU?=
 =?us-ascii?Q?UbGaxZ28L4NGfEOszNkLNIjvf8c+43pQO92SxKFS/iRp/PTFNUcdb22lyBAJ?=
 =?us-ascii?Q?1HLsK+Mj8VYETq39QjOciZ1cDqrDi1S1zAahUvWRoimubV+p6FnrCEktTZpX?=
 =?us-ascii?Q?LzkgeJiqIXz2sYfOc04vTY1ygGs2h8sLEH2YGeIX/m+ceUhBSpRRbM523J5U?=
 =?us-ascii?Q?RXXk8aE4dluXvsGJXdgAb25SviEC0uONoidj1JsUOCU5933CHVdvgex1705K?=
 =?us-ascii?Q?3sZedhLX8Avl7G1ggE/bkrlsHmTtYRQv4yRVMsw6FmhYqDfUFDVYLcPO/+0k?=
 =?us-ascii?Q?GadZ6Ga3AVuPPPiUebcss5Jzo/1tUn37eYeKLWMp4xplD/9Ajo+kW5xOzRja?=
 =?us-ascii?Q?iYut5rO+YEOCNIXMp+SOo3GCkgWGacUeD0hNOJP/P60KSx3K3H6jHhCf1n5x?=
 =?us-ascii?Q?oCVufy61KqYuNMIdrTrjhJLxij7SZqeyqLnXhw2XFh9pSBzhxMZ6LINUuzpE?=
 =?us-ascii?Q?hakQeBS0Xo6uW9Q0SMmcfbri8TSD5XHTxqOPc2MIrUkR4OYLfCTCT7r+vybq?=
 =?us-ascii?Q?+PmVgoJ2PaR9bZtZcKCU0i8Fdg8w7JRuvzeXk3RZdMeRWeuA2k+tBWYVhTGz?=
 =?us-ascii?Q?zxg5R5VJRBCcsu1gbsjVoDSYjcu+g8zlrUN7VRLrQwS+nDmTRU7731DepF91?=
 =?us-ascii?Q?BR7g5EC+CbXNjO5H0/zxdjxYkRdKt1HAOteYw96Ib1fm7+4a2+krEGgHofGt?=
 =?us-ascii?Q?U6j1Ea4G5zKFSSPUKw0wo4IXEyQAegNcIVbdNiVT2Jmr+THbm+T/lFwEfPgQ?=
 =?us-ascii?Q?YSGwMT+BX/pum9N9L7Dgwhlci/2a3mkQ2bpCIEgAYJI/h75RIL3qFXCwao7Y?=
 =?us-ascii?Q?LB6/hMe015smHq8TLNAKzAfmEP0aOEnleIHcGl/CWLuAVL76524=3D?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: BY5PR10MB4129.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: c197e2ca-1107-4f69-3c98-08db7e640660
X-MS-Exchange-CrossTenant-originalarrivaltime: 06 Jul 2023 21:00:27.1671
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: 5HfUm1HlDIKFT+MsUu7frUVaGZsohaL+Zf+LQPBJPiLLqKlhSPn3cY72kRkNNw/5c4sspL0SG6ZEEynD96Cn7RFKf05x4BX1atAILcl2qr0=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: IA1PR10MB6805
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.254,Aquarius:18.0.957,Hydra:6.0.591,FMLib:17.11.176.26
 definitions=2023-07-06_15,2023-07-06_02,2023-05-22_02
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 adultscore=0 bulkscore=0 suspectscore=0
 malwarescore=0 phishscore=0 mlxscore=0 spamscore=0 mlxlogscore=999
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2305260000
 definitions=main-2307060185
X-Proofpoint-GUID: 14bAjowhWcX0kjZn9Feo6UaVjZ5PaM1V
X-Proofpoint-ORIG-GUID: 14bAjowhWcX0kjZn9Feo6UaVjZ5PaM1V
X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,
        RCVD_IN_MSPIKE_H5,RCVD_IN_MSPIKE_WL,SPF_HELO_NONE,SPF_NONE,
        T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org


> On Jul 6, 2023, at 1:16 PM, Liam Howlett <liam.howlett@oracle.com> wrote:
>=20
> * Anjali Kulkarni <anjali.k.kulkarni@oracle.com> [691231 23:00]:
>> There were a couple of reasons for not allowing non-root users access
>> initially - one is there was some point no proper receive buffer
>> management in place for netlink multicast. But that should be long
>> fixed. See link below for more context.
>>=20
>> Second is that some of the messages may contain data that is root only. =
But
>> this should be handled with a finer granularity, which is being done at =
the
>> protocol layer. The only problematic protocols are nf_queue and the
>> firewall netlink. Hence, this restriction for non-root access was relaxe=
d
>> for NETLINK_ROUTE initially:
>> https://lore.kernel.org/all/20020612013101.A22399@wotan.suse.de/
>>=20
>> This restriction has also been removed for following protocols:
>> NETLINK_KOBJECT_UEVENT, NETLINK_AUDIT, NETLINK_SOCK_DIAG,
>> NETLINK_GENERIC, NETLINK_SELINUX.
>>=20
>> Since process connector messages are not sensitive (process fork, exit
>> notifications etc.), and anyone can read /proc data, we can allow non-ro=
ot
>> access here. However, since process event notification is not the only
>> consumer of NETLINK_CONNECTOR, we can make this change even more
>> fine grained than the protocol level, by checking for multicast group
>> within the protocol.
>>=20
>> Allow non-root access for NETLINK_CONNECTOR via NL_CFG_F_NONROOT_RECV
>> but add new bind function cn_bind(), which allows non-root access only
>> for CN_IDX_PROC multicast group.
>>=20
>> Signed-off-by: Anjali Kulkarni <anjali.k.kulkarni@oracle.com>
>> ---
>> drivers/connector/cn_proc.c | 7 -------
>> drivers/connector/connector.c | 19 +++++++++++++++++++
>> 2 files changed, 19 insertions(+), 7 deletions(-)
>>=20
>> diff --git a/drivers/connector/cn_proc.c b/drivers/connector/cn_proc.c
>> index dfc84d44f804..bb1fa5d66cf9 100644
>> --- a/drivers/connector/cn_proc.c
>> +++ b/drivers/connector/cn_proc.c
>> @@ -410,12 +410,6 @@ static void cn_proc_mcast_ctl(struct cn_msg *msg,
>> 	 !task_is_in_init_pid_ns(current))
>> 		return;
>>=20
>> -	/* Can only change if privileged. */
>> -	if (!__netlink_ns_capable(nsp, &init_user_ns, CAP_NET_ADMIN)) {
>> -		err =3D EPERM;
>> -		goto out;
>> -	}
>> -
>> 	if (msg->len =3D=3D sizeof(*pinput)) {
>> 		pinput =3D (struct proc_input *)msg->data;
>> 		mc_op =3D pinput->mcast_op;
>> @@ -467,7 +461,6 @@ static void cn_proc_mcast_ctl(struct cn_msg *msg,
>> 		break;
>> 	}
>>=20
>> -out:
>=20
> This label is still in use from your changes in patch 3.

Yes, will send updated patch with this fixed.

>=20
>> 	cn_proc_ack(err, msg->seq, msg->ack);
>> }
>>=20
>> diff --git a/drivers/connector/connector.c b/drivers/connector/connector=
.c
>> index d1179df2b0ba..7f7b94f616a6 100644
>> --- a/drivers/connector/connector.c
>> +++ b/drivers/connector/connector.c
>> @@ -166,6 +166,23 @@ static int cn_call_callback(struct sk_buff *skb)
>> 	return err;
>> }
>>=20
>> +/*
>> + * Allow non-root access for NETLINK_CONNECTOR family having CN_IDX_PRO=
C
>> + * multicast group.
>> + */
>> +static int cn_bind(struct net *net, int group)
>> +{
>> +	unsigned long groups =3D (unsigned long) group;
>> +
>> +	if (ns_capable(net->user_ns, CAP_NET_ADMIN))
>> +		return 0;
>> +
>> +	if (test_bit(CN_IDX_PROC - 1, &groups))
>> +		return 0;
>> +
>> +	return -EPERM;
>> +}
>> +
>> static void cn_release(struct sock *sk, unsigned long *groups)
>> {
>> 	if (groups && test_bit(CN_IDX_PROC - 1, groups)) {
>> @@ -261,6 +278,8 @@ static int cn_init(void)
>> 	struct netlink_kernel_cfg cfg =3D {
>> 		.groups	=3D CN_NETLINK_USERS + 0xf,
>> 		.input	=3D cn_rx_skb,
>> +		.flags =3D NL_CFG_F_NONROOT_RECV,
>> +		.bind =3D cn_bind,
>> 		.release =3D cn_release,
>> 	};
>>=20
>> --=20
>> 2.41.0