Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 82ea58d6 authored by Chris Lew's avatar Chris Lew Committed by Gerrit - the friendly Code Review server
Browse files

net: qrtr: Allow control port access to AID_VENDOR_QRTR 



Only allow processes to bind to the control port if they are in the
AID_VENDOR_QRTR group or have NET_ADMIN capabilities. This GID is
reserved for QRTR control applications only.

Remove NET_BIND_SERVICE check from netlink socket callback. This is a
redundant check since NET_ADMIN is a more priveleged capability.

Change-Id: I70961418314c391017709cab6408e5c58cf6d848
Signed-off-by: default avatarChris Lew <clew@codeaurora.org>
parent 90722ec6

net/qrtr/qrtr.c

+6 −3
Original line number Diff line number Diff line
@@ -18,6 +18,7 @@ 
#include <linux/wait.h>

#include <linux/rwsem.h>

#include <linux/ipc_logging.h>

#include <linux/uidgid.h>



#include <net/sock.h>
@@ -38,6 +39,8 @@ 
#define QRTR_STATE_MULTI	-2

#define QRTR_STATE_INIT	-1



#define AID_VENDOR_QRTR	KGIDT_INIT(2906)



/**

 * struct qrtr_hdr_v1 - (I|R)PCrouter packet header version 1

 * @version: protocol version
@@ -920,7 +923,8 @@ static int qrtr_port_assign(struct qrtr_sock *ipc, int *port) 
			       GFP_ATOMIC);

		if (rc >= 0)

			*port = rc;

	} else if (*port < QRTR_MIN_EPH_SOCKET && !capable(CAP_NET_ADMIN)) {

	} else if (*port < QRTR_MIN_EPH_SOCKET &&

		   !(capable(CAP_NET_ADMIN) || in_egroup_p(AID_VENDOR_QRTR))) {

		rc = -EACCES;

	} else if (*port == QRTR_PORT_CTRL) {

		rc = idr_alloc(&qrtr_ports, ipc, 0, 1, GFP_ATOMIC);
@@ -1493,8 +1497,7 @@ static int qrtr_addr_doit(struct sk_buff *skb, struct nlmsghdr *nlh, 
	struct ifaddrmsg *ifm;

	int rc;



	if (!netlink_capable(skb, CAP_NET_ADMIN) &&

	    !netlink_capable(skb, CAP_NET_BIND_SERVICE))

	if (!netlink_capable(skb, CAP_NET_ADMIN))

		return -EPERM;



	ASSERT_RTNL();