lkml.org 
[lkml]   [2020]   [Nov]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.19 52/71] vsock: use ns_capable_noaudit() on socket create
    Date
    From: Jeff Vander Stoep <jeffv@google.com>

    [ Upstream commit af545bb5ee53f5261db631db2ac4cde54038bdaf ]

    During __vsock_create() CAP_NET_ADMIN is used to determine if the
    vsock_sock->trusted should be set to true. This value is used later
    for determing if a remote connection should be allowed to connect
    to a restricted VM. Unfortunately, if the caller doesn't have
    CAP_NET_ADMIN, an audit message such as an selinux denial is
    generated even if the caller does not want a trusted socket.

    Logging errors on success is confusing. To avoid this, switch the
    capable(CAP_NET_ADMIN) check to the noaudit version.

    Reported-by: Roman Kiryanov <rkir@google.com>
    https://android-review.googlesource.com/c/device/generic/goldfish/+/1468545/
    Signed-off-by: Jeff Vander Stoep <jeffv@google.com>
    Reviewed-by: James Morris <jamorris@linux.microsoft.com>
    Link: https://lore.kernel.org/r/20201023143757.377574-1-jeffv@google.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    net/vmw_vsock/af_vsock.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
    index c88dc8ee3144b..02374459c4179 100644
    --- a/net/vmw_vsock/af_vsock.c
    +++ b/net/vmw_vsock/af_vsock.c
    @@ -629,7 +629,7 @@ struct sock *__vsock_create(struct net *net,
    vsk->owner = get_cred(psk->owner);
    vsk->connect_timeout = psk->connect_timeout;
    } else {
    - vsk->trusted = capable(CAP_NET_ADMIN);
    + vsk->trusted = ns_capable_noaudit(&init_user_ns, CAP_NET_ADMIN);
    vsk->owner = get_current_cred();
    vsk->connect_timeout = VSOCK_DEFAULT_CONNECT_TIMEOUT;
    }
    --
    2.27.0


    \
     
     \ /
      Last update: 2020-11-09 14:10    [W:3.763 / U:0.004 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site