github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-05-12 16:18:45 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity

wifi: nl80211: require CAP_NET_ADMIN over the target netns in SET_WIPHY_NETNS

Browse Source 
NL80211_CMD_SET_WIPHY_NETNS dispatches with GENL_UNS_ADMIN_PERM, which
verifies that the caller has CAP_NET_ADMIN for the source netns. It
doesn't verify that the caller has CAP_NET_ADMIN over the target netns
selected by NL80211_ATTR_NETNS_FD or NL80211_ATTR_PID.

This diverges from the convention enforced in
net/core/rtnetlink.c::rtnl_get_net_ns_capable():

    /* For now, the caller is required to have CAP_NET_ADMIN in
     * the user namespace owning the target net ns.
     */
    if (!sk_ns_capable(sk, net->user_ns, CAP_NET_ADMIN))
        return ERR_PTR(-EACCES);

A user with CAP_NET_ADMIN in their own user namespace can therefore
push a wiphy into an arbitrary netns (including init_net) over which
they have no privilege.

Mirror the rtnetlink convention by requiring CAP_NET_ADMIN in the
target netns before calling cfg80211_switch_netns().

Signed-off-by: Maoyi Xie <maoyi.xie@ntu.edu.sg>
Link: https://patch.msgid.link/20260506064854.2207105-2-maoyixie.tju@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
This commit is contained in:
Maoyi Xie 2026-05-06 14:48:53 +08:00 committed by Johannes Berg
parent 0f3c0a1973
commit 15994bb0cb
1 changed files with 13 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
net/wireless/nl80211.c
View File

@ -13867,6 +13867,19 @@ static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
if (IS_ERR(net))
return PTR_ERR(net);
/*
* The caller already has CAP_NET_ADMIN over the source netns
* (enforced by GENL_UNS_ADMIN_PERM on the genl op). Mirror the
* convention used by net/core/rtnetlink.c::rtnl_get_net_ns_capable()
* and require CAP_NET_ADMIN over the target netns as well, so that
* a caller that is privileged in their own user namespace cannot
* push a wiphy into a netns where they have no privilege.
*/
if (!ns_capable(net->user_ns, CAP_NET_ADMIN)) {
put_net(net);
return -EPERM;
}
err = 0;
/* check if anything to do */