diff options
| author | Jo-Philipp Wich <jo@mein.io> | 2016-07-04 20:46:24 +0200 |
|---|---|---|
| committer | Zoltan HERPAI <wigyori@uid0.hu> | 2016-07-04 20:46:24 +0200 |
| commit | 94a986d88ffdc6868aaf13e6a18cb220434adbef (patch) | |
| tree | 800e081573dc641563293733f36a76c945feb5e4 /target | |
| parent | 8207cd3298c926ac66e2aba188c4846d7ed69649 (diff) | |
| download | master-187ad058-94a986d88ffdc6868aaf13e6a18cb220434adbef.tar.gz master-187ad058-94a986d88ffdc6868aaf13e6a18cb220434adbef.tar.bz2 master-187ad058-94a986d88ffdc6868aaf13e6a18cb220434adbef.zip | |
kernel: deny swconfig set requests for unprivileged users
The swconfig kernel infrastructure fails to do any permissions checks when
changing settings. As such an ordinary user account on a device with a
switch can change switch settings without any special permissions.
Routers generally have few non-admin users so this isn't a big hole, but it
is a security hole. Likely the greatest danger is for multifunction devices
which have a lot of extra daemons, compromising a low-security daemon would
allow one to modify switch settings and cause the router/switch to appear to
lock-up (or cause other sorts of troublesome nyetwork behavior).
Implement a check for CAP_NET_ADMIN in swconfig_set_attr() and deny any
requests originating from user contexts lacking this capability.
Reported-by: Elliott Mitchell <ehem+openwrt@m5p.com>
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
Diffstat (limited to 'target')
| -rw-r--r-- | target/linux/generic/files/drivers/net/phy/swconfig.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/target/linux/generic/files/drivers/net/phy/swconfig.c b/target/linux/generic/files/drivers/net/phy/swconfig.c index b556510aef..699abd33dd 100644 --- a/target/linux/generic/files/drivers/net/phy/swconfig.c +++ b/target/linux/generic/files/drivers/net/phy/swconfig.c @@ -635,6 +635,9 @@ swconfig_set_attr(struct sk_buff *skb, struct genl_info *info) struct switch_val val; int err = -EINVAL; + if (!capable(CAP_NET_ADMIN)) + return -EPERM; + dev = swconfig_get_dev(info); if (!dev) return -EINVAL; |