lkml.org 
[lkml]   [2023]   [Feb]   [4]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    Subject[PATCH net-next v3 0/3] tuntap: correctly initialize socket uid
    Date
    sock_init_data() assumes that the `struct socket` passed in input is
    contained in a `struct socket_alloc` allocated with sock_alloc().
    However, tap_open() and tun_chr_open() pass a `struct socket` embedded
    in a `struct tap_queue` and `struct tun_file` respectively, both
    allocated with sk_alloc().
    This causes a type confusion when issuing a container_of() with
    SOCK_INODE() in sock_init_data() which results in assigning a wrong
    sk_uid to the `struct sock` in input.

    Due to the type confusion, both sockets happen to have their uid set
    to 0, i.e. root.
    While it will be often correct, as tuntap devices require
    CAP_NET_ADMIN, it may not always be the case.
    Not sure how widespread is the impact of this, it seems the socket uid
    may be used for network filtering and routing, thus tuntap sockets may
    be incorrectly managed.
    Additionally, it seems a socket with an incorrect uid may be returned
    to the vhost driver when issuing a get_socket() on a tuntap device in
    vhost_net_set_backend().

    Fix the bugs by adding and using sock_init_data_uid(), which
    explicitly takes a uid as argument.

    Signed-off-by: Pietro Borrello <borrello@diag.uniroma1.it>
    ---
    Changes in v3:
    - Fix the bug by defining and using sock_init_data_uid()
    - Link to v2: https://lore.kernel.org/r/20230131-tuntap-sk-uid-v2-0-29ec15592813@diag.uniroma1.it

    Changes in v2:
    - Shorten and format comments
    - Link to v1: https://lore.kernel.org/r/20230131-tuntap-sk-uid-v1-0-af4f9f40979d@diag.uniroma1.it

    ---
    Pietro Borrello (3):
    net: add sock_init_data_uid()
    tun: tun_chr_open(): correctly initialize socket uid
    tap: tap_open(): correctly initialize socket uid

    drivers/net/tap.c | 2 +-
    drivers/net/tun.c | 2 +-
    include/net/sock.h | 7 ++++++-
    net/core/sock.c | 15 ++++++++++++---
    4 files changed, 20 insertions(+), 6 deletions(-)
    ---
    base-commit: 6d796c50f84ca79f1722bb131799e5a5710c4700
    change-id: 20230131-tuntap-sk-uid-78efc80f4b82

    Best regards,
    --
    Pietro Borrello <borrello@diag.uniroma1.it>

    \
     
     \ /
      Last update: 2023-03-27 00:10    [W:2.089 / U:0.032 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site