Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit db0e0794 authored by Robert Love's avatar Robert Love Committed by Ruchi Kandoi
Browse files

Paranoid network. 



With CONFIG_ANDROID_PARANOID_NETWORK, require specific uids/gids to instantiate
network sockets.

Signed-off-by: default avatarRobert Love <rlove@google.com>

paranoid networking: Use in_egroup_p() to check group membership

The previous group_search() caused trouble for partners with module builds.
in_egroup_p() is also cleaner.

Signed-off-by: default avatarNick Pelly <npelly@google.com>

Fix 2.6.29 build.

Signed-off-by: default avatarArve Hjønnevåg <arve@android.com>

net: Fix compilation of the IPv6 module

Fix compilation of the IPv6 module -- current->euid does not exist anymore,
current_euid() is what needs to be used.

Signed-off-by: default avatarSteinar H. Gunderson <sesse@google.com>

net: bluetooth: Remove the AID_NET_BT* gid numbers

Removed bluetooth checks for AID_NET_BT and AID_NET_BT_ADMIN
which are not useful anymore.
This is in preparation for getting rid of all the AID_* gids.

Signed-off-by: default avatarJP Abgrall <jpa@google.com>
parent 2e8e5a06

net/Kconfig

+6 −0
Original line number Diff line number Diff line
@@ -83,6 +83,12 @@ source "net/netlabel/Kconfig" 


endif # if INET



config ANDROID_PARANOID_NETWORK

	bool "Only allow certain groups to create sockets"

	default y

	help

		none



config NETWORK_SECMARK

	bool "Security Marking"

	help

net/bluetooth/af_bluetooth.c

+29 −0
Original line number Diff line number Diff line
@@ -104,11 +104,40 @@ void bt_sock_unregister(int proto) 
}

EXPORT_SYMBOL(bt_sock_unregister);



#ifdef CONFIG_PARANOID_NETWORK

static inline int current_has_bt_admin(void)

{

	return !current_euid();

}



static inline int current_has_bt(void)

{

	return current_has_bt_admin();

}

# else

static inline int current_has_bt_admin(void)

{

	return 1;

}



static inline int current_has_bt(void)

{

	return 1;

}

#endif



static int bt_sock_create(struct net *net, struct socket *sock, int proto,

			  int kern)

{

	int err;



	if (proto == BTPROTO_RFCOMM || proto == BTPROTO_SCO ||

			proto == BTPROTO_L2CAP) {

		if (!current_has_bt())

			return -EPERM;

	} else if (!current_has_bt_admin())

		return -EPERM;



	if (net != &init_net)

		return -EAFNOSUPPORT;

net/ipv4/af_inet.c

+30 −1
Original line number Diff line number Diff line
@@ -119,6 +119,9 @@ 
#include <linux/mroute.h>

#endif



#ifdef CONFIG_ANDROID_PARANOID_NETWORK

#include <linux/android_aid.h>

#endif



/* The inetsw table contains everything that inet_create needs to

 * build a new socket.
@@ -242,6 +245,29 @@ out: 
}

EXPORT_SYMBOL(inet_listen);



#ifdef CONFIG_ANDROID_PARANOID_NETWORK

static inline int current_has_network(void)

{

	return (!current_euid() || in_egroup_p(AID_INET) ||

		in_egroup_p(AID_NET_RAW));

}

static inline int current_has_cap(struct net *net, int cap)

{

	if (cap == CAP_NET_RAW && in_egroup_p(AID_NET_RAW))

		return 1;

	return ns_capable(net->user_ns, cap);

}

# else

static inline int current_has_network(void)

{

	return 1;

}

static inline int current_has_cap(struct net *net, int cap)

{

	return ns_capable(net->user_ns, cap);

}

#endif



/*

 *	Create an inet socket.

 */
@@ -257,6 +283,9 @@ static int inet_create(struct net *net, struct socket *sock, int protocol, 
	int try_loading_module = 0;

	int err;



	if (!current_has_network())

		return -EACCES;



	sock->state = SS_UNCONNECTED;



	/* Look for the requested type/protocol pair. */
@@ -306,7 +335,7 @@ lookup_protocol: 


	err = -EPERM;

	if (sock->type == SOCK_RAW && !kern &&

	    !ns_capable(net->user_ns, CAP_NET_RAW))

	    !current_has_cap(net, CAP_NET_RAW))

		goto out_rcu_unlock;



	sock->ops = answer->ops;

net/ipv6/af_inet6.c

+31 −1
Original line number Diff line number Diff line
@@ -64,6 +64,10 @@ 
#include <asm/uaccess.h>

#include <linux/mroute6.h>



#ifdef CONFIG_ANDROID_PARANOID_NETWORK

#include <linux/android_aid.h>

#endif



MODULE_AUTHOR("Cast of dozens");

MODULE_DESCRIPTION("IPv6 protocol stack for Linux");

MODULE_LICENSE("GPL");
@@ -97,6 +101,29 @@ static __inline__ struct ipv6_pinfo *inet6_sk_generic(struct sock *sk) 
	return (struct ipv6_pinfo *)(((u8 *)sk) + offset);

}



#ifdef CONFIG_ANDROID_PARANOID_NETWORK

static inline int current_has_network(void)

{

	return (!current_euid() || in_egroup_p(AID_INET) ||

		in_egroup_p(AID_NET_RAW));

}

static inline int current_has_cap(struct net *net, int cap)

{

	if (cap == CAP_NET_RAW && in_egroup_p(AID_NET_RAW))

		return 1;

	return ns_capable(net->user_ns, cap);

}

# else

static inline int current_has_network(void)

{

	return 1;

}

static inline int current_has_cap(struct net *net, int cap)

{

	return ns_capable(net->user_ns, cap);

}

#endif



static int inet6_create(struct net *net, struct socket *sock, int protocol,

			int kern)

{
@@ -109,6 +136,9 @@ static int inet6_create(struct net *net, struct socket *sock, int protocol, 
	int try_loading_module = 0;

	int err;



	if (!current_has_network())

		return -EACCES;



	/* Look for the requested type/protocol pair. */

lookup_protocol:

	err = -ESOCKTNOSUPPORT;
@@ -156,7 +186,7 @@ lookup_protocol: 


	err = -EPERM;

	if (sock->type == SOCK_RAW && !kern &&

	    !ns_capable(net->user_ns, CAP_NET_RAW))

	    !current_has_cap(net, CAP_NET_RAW))

		goto out_rcu_unlock;



	sock->ops = answer->ops;