Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d94bbc32 authored by Nick Kralevich's avatar Nick Kralevich Committed by Android Git Automerger
Browse files

am 6bc08280: Validate sender credentials on netlink msg receive

* commit '6bc08280':
  Validate sender credentials on netlink msg receive
parents b98762f7 6bc08280
Loading
Loading
Loading
Loading
+26 −3
Original line number Diff line number Diff line
@@ -17,6 +17,7 @@

#include <sys/types.h>
#include <sys/socket.h>
#include <linux/netlink.h>
#include <string.h>

#define LOG_TAG "NetlinkListener"
@@ -32,11 +33,33 @@ NetlinkListener::NetlinkListener(int socket) :
bool NetlinkListener::onDataAvailable(SocketClient *cli)
{
    int socket = cli->getSocket();
    int count;
    ssize_t count;
    char cred_msg[CMSG_SPACE(sizeof(struct ucred))];
    struct sockaddr_nl snl;
    struct iovec iov = {mBuffer, sizeof(mBuffer)};
    struct msghdr hdr = {&snl, sizeof(snl), &iov, 1, cred_msg, sizeof(cred_msg), 0};

    count = TEMP_FAILURE_RETRY(recv(socket, mBuffer, sizeof(mBuffer), 0));
    count = TEMP_FAILURE_RETRY(recvmsg(socket, &hdr, 0));
    if (count < 0) {
        SLOGE("recv failed (%s)", strerror(errno));
        SLOGE("recvmsg failed (%s)", strerror(errno));
        return false;
    }

    if ((snl.nl_groups != 1) || (snl.nl_pid != 0)) {
        SLOGE("ignoring non-kernel netlink multicast message");
        return false;
    }

    struct cmsghdr * cmsg = CMSG_FIRSTHDR(&hdr);

    if (cmsg == NULL || cmsg->cmsg_type != SCM_CREDENTIALS) {
        SLOGE("ignoring message with no sender credentials");
        return false;
    }

    struct ucred * cred = (struct ucred *)CMSG_DATA(cmsg);
    if (cred->uid != 0) {
        SLOGE("ignoring message from non-root UID %d", cred->uid);
        return false;
    }