When a prison is given the ability to create raw sockets (when the
security.jail.allow_raw_sockets sysctl MIB is set to 1) where privileged access to jails is given out, it is possible for prison root to manipulate various network parameters which effect the host environment. This commit plugs a number of security holes associated with the use of raw sockets and prisons. This commit makes the following changes: - Add a comment to rtioctl warning developers that if they add any ioctl commands, they should use super-user checks where necessary, as it is possible for PRISON root to make it this far in execution. - Add super-user checks for the execution of the SIOCGETVIFCNT and SIOCGETSGCNT IP multicast ioctl commands. - Add a super-user check to rip_ctloutput(). If the calling cred is PRISON root, make sure the socket option name is IP_HDRINCL, otherwise deny the request. Although this patch corrects a number of security problems associated with raw sockets and prisons, the warning in jail(8) should still apply, and by default we should keep the default value of security.jail.allow_raw_sockets MIB to 0 (or disabled) until we are certain that we have tracked down all the problems. Looking forward, we will probably want to eliminate the references to curthread. This may be a MFC candidate for RELENG_5. Reviewed by: rwatson Approved by: bmilekic (mentor)
This commit is contained in:
parent
5a0192650e
commit
5090559b7f
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=134122
@ -416,6 +416,13 @@ rtredirect(struct sockaddr *dst,
|
||||
int
|
||||
rtioctl(u_long req, caddr_t data)
|
||||
{
|
||||
|
||||
/*
|
||||
* If more ioctl commands are added here, make sure the proper
|
||||
* super-user checks are being performed because it is possible for
|
||||
* prison-root to make it this far if raw sockets have been enabled
|
||||
* in jails.
|
||||
*/
|
||||
#ifdef INET
|
||||
/* Multicast goop, grrr... */
|
||||
return mrt_ioctl ? mrt_ioctl(req, data) : EOPNOTSUPP;
|
||||
|
@ -526,6 +526,14 @@ X_mrt_ioctl(int cmd, caddr_t data)
|
||||
{
|
||||
int error = 0;
|
||||
|
||||
/*
|
||||
* Currently the only function calling this ioctl routine is rtioctl().
|
||||
* Typically, only root can create the raw socket in order to execute
|
||||
* this ioctl method, however the request might be coming from a prison
|
||||
*/
|
||||
error = suser(curthread);
|
||||
if (error)
|
||||
return (error);
|
||||
switch (cmd) {
|
||||
case (SIOCGETVIFCNT):
|
||||
error = get_vif_cnt((struct sioc_vif_req *)data);
|
||||
|
@ -344,6 +344,16 @@ rip_ctloutput(struct socket *so, struct sockopt *sopt)
|
||||
if (sopt->sopt_level != IPPROTO_IP)
|
||||
return (EINVAL);
|
||||
|
||||
/*
|
||||
* Even though super-user is required to create a raw socket, the
|
||||
* calling cred could be prison root. If so we want to restrict the
|
||||
* access to IP_HDRINCL only.
|
||||
*/
|
||||
if (sopt->sopt_name != IP_HDRINCL) {
|
||||
error = suser(curthread);
|
||||
if (error != 0)
|
||||
return (error);
|
||||
}
|
||||
error = 0;
|
||||
|
||||
switch (sopt->sopt_dir) {
|
||||
|
Loading…
Reference in New Issue
Block a user