Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ec2622b0 authored by Robert Love's avatar Robert Love Committed by Dmitry Shmidt
Browse files

ANDROID: Paranoid network. 



With CONFIG_ANDROID_PARANOID_NETWORK, require specific uids/gids to instantiate
network sockets.

Signed-off-by: default avatarRobert Love <rlove@google.com>

paranoid networking: Use in_egroup_p() to check group membership

The previous group_search() caused trouble for partners with module builds.
in_egroup_p() is also cleaner.

Signed-off-by: default avatarNick Pelly <npelly@google.com>

Fix 2.6.29 build.

Signed-off-by: default avatarArve Hjønnevåg <arve@android.com>

net: Fix compilation of the IPv6 module

Fix compilation of the IPv6 module -- current->euid does not exist anymore,
current_euid() is what needs to be used.

Signed-off-by: default avatarSteinar H. Gunderson <sesse@google.com>

net: bluetooth: Remove the AID_NET_BT* gid numbers

Removed bluetooth checks for AID_NET_BT and AID_NET_BT_ADMIN
which are not useful anymore.
This is in preparation for getting rid of all the AID_* gids.

Change-Id: I879d7181f07532784499ef152288d12a03ab6354
Signed-off-by: default avatarJP Abgrall <jpa@google.com>
parent a2624d7b

net/Kconfig

+6 −0
Original line number Diff line number Diff line
@@ -89,6 +89,12 @@ source "net/netlabel/Kconfig" 


endif # if INET



config ANDROID_PARANOID_NETWORK

	bool "Only allow certain groups to create sockets"

	default y

	help

		none



config NETWORK_SECMARK

	bool "Security Marking"

	help

net/bluetooth/af_bluetooth.c

+29 −0
Original line number Diff line number Diff line
@@ -106,11 +106,40 @@ void bt_sock_unregister(int proto) 
}

EXPORT_SYMBOL(bt_sock_unregister);



#ifdef CONFIG_PARANOID_NETWORK

static inline int current_has_bt_admin(void)

{

	return !current_euid();

}



static inline int current_has_bt(void)

{

	return current_has_bt_admin();

}

# else

static inline int current_has_bt_admin(void)

{

	return 1;

}



static inline int current_has_bt(void)

{

	return 1;

}

#endif



static int bt_sock_create(struct net *net, struct socket *sock, int proto,

			  int kern)

{

	int err;



	if (proto == BTPROTO_RFCOMM || proto == BTPROTO_SCO ||

			proto == BTPROTO_L2CAP) {

		if (!current_has_bt())

			return -EPERM;

	} else if (!current_has_bt_admin())

		return -EPERM;



	if (net != &init_net)

		return -EAFNOSUPPORT;

net/ipv4/af_inet.c

+30 −1
Original line number Diff line number Diff line
@@ -121,6 +121,9 @@ 
#endif

#include <net/l3mdev.h>



#ifdef CONFIG_ANDROID_PARANOID_NETWORK

#include <linux/android_aid.h>

#endif



/* The inetsw table contains everything that inet_create needs to

 * build a new socket.
@@ -237,6 +240,29 @@ int inet_listen(struct socket *sock, int backlog) 
}

EXPORT_SYMBOL(inet_listen);



#ifdef CONFIG_ANDROID_PARANOID_NETWORK

static inline int current_has_network(void)

{

	return (!current_euid() || in_egroup_p(AID_INET) ||

		in_egroup_p(AID_NET_RAW));

}

static inline int current_has_cap(struct net *net, int cap)

{

	if (cap == CAP_NET_RAW && in_egroup_p(AID_NET_RAW))

		return 1;

	return ns_capable(net->user_ns, cap);

}

# else

static inline int current_has_network(void)

{

	return 1;

}

static inline int current_has_cap(struct net *net, int cap)

{

	return ns_capable(net->user_ns, cap);

}

#endif



/*

 *	Create an inet socket.

 */
@@ -255,6 +281,9 @@ static int inet_create(struct net *net, struct socket *sock, int protocol, 
	if (protocol < 0 || protocol >= IPPROTO_MAX)

		return -EINVAL;



	if (!current_has_network())

		return -EACCES;



	sock->state = SS_UNCONNECTED;



	/* Look for the requested type/protocol pair. */
@@ -304,7 +333,7 @@ static int inet_create(struct net *net, struct socket *sock, int protocol, 


	err = -EPERM;

	if (sock->type == SOCK_RAW && !kern &&

	    !ns_capable(net->user_ns, CAP_NET_RAW))

	    !current_has_cap(net, CAP_NET_RAW))

		goto out_rcu_unlock;



	sock->ops = answer->ops;

net/ipv6/af_inet6.c

+31 −1
Original line number Diff line number Diff line
@@ -65,6 +65,10 @@ 
#include <asm/uaccess.h>

#include <linux/mroute6.h>



#ifdef CONFIG_ANDROID_PARANOID_NETWORK

#include <linux/android_aid.h>

#endif



#include "ip6_offload.h"



MODULE_AUTHOR("Cast of dozens");
@@ -106,6 +110,29 @@ static __inline__ struct ipv6_pinfo *inet6_sk_generic(struct sock *sk) 
	return (struct ipv6_pinfo *)(((u8 *)sk) + offset);

}



#ifdef CONFIG_ANDROID_PARANOID_NETWORK

static inline int current_has_network(void)

{

	return (!current_euid() || in_egroup_p(AID_INET) ||

		in_egroup_p(AID_NET_RAW));

}

static inline int current_has_cap(struct net *net, int cap)

{

	if (cap == CAP_NET_RAW && in_egroup_p(AID_NET_RAW))

		return 1;

	return ns_capable(net->user_ns, cap);

}

# else

static inline int current_has_network(void)

{

	return 1;

}

static inline int current_has_cap(struct net *net, int cap)

{

	return ns_capable(net->user_ns, cap);

}

#endif



static int inet6_create(struct net *net, struct socket *sock, int protocol,

			int kern)

{
@@ -121,6 +148,9 @@ static int inet6_create(struct net *net, struct socket *sock, int protocol, 
	if (protocol < 0 || protocol >= IPPROTO_MAX)

		return -EINVAL;



	if (!current_has_network())

		return -EACCES;



	/* Look for the requested type/protocol pair. */

lookup_protocol:

	err = -ESOCKTNOSUPPORT;
@@ -168,7 +198,7 @@ static int inet6_create(struct net *net, struct socket *sock, int protocol, 


	err = -EPERM;

	if (sock->type == SOCK_RAW && !kern &&

	    !ns_capable(net->user_ns, CAP_NET_RAW))

	    !current_has_cap(net, CAP_NET_RAW))

		goto out_rcu_unlock;



	sock->ops = answer->ops;