1 From 8095074e1aa2b308d8134638999a0ffe25e12347 Mon Sep 17 00:00:00 2001
2 From: Christian Brauner <christian.brauner@ubuntu.com>
3 Date: Sat, 28 Jan 2017 13:02:34 +0100
4 Subject: [PATCH 9/9] CVE-2017-5985: Ensure target netns is caller-owned
6 Before this commit, lxc-user-nic could potentially have been tricked into
7 operating on a network namespace over which the caller did not hold privilege.
9 This commit ensures that the caller is privileged over the network namespace by
10 temporarily dropping privilege.
12 Launchpad: https://bugs.launchpad.net/ubuntu/+source/lxc/+bug/1654676
13 Reported-by: Jann Horn <jannh@google.com>
14 Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
16 src/lxc/lxc_user_nic.c | 119 ++++++++++++++++++++++++++++++++++++-------------
17 1 file changed, 87 insertions(+), 32 deletions(-)
19 diff --git a/src/lxc/lxc_user_nic.c b/src/lxc/lxc_user_nic.c
20 index 409a53a..96dc398 100644
21 --- a/src/lxc/lxc_user_nic.c
22 +++ b/src/lxc/lxc_user_nic.c
27 +#define usernic_debug_stream(stream, format, ...) \
29 + fprintf(stream, "%s: %d: %s: " format, __FILE__, __LINE__, \
30 + __func__, __VA_ARGS__); \
33 +#define usernic_error(format, ...) usernic_debug_stream(stderr, format, __VA_ARGS__)
35 static void usage(char *me, bool fail)
37 fprintf(stderr, "Usage: %s lxcpath name pid type bridge nicname\n", me);
38 @@ -670,68 +678,115 @@ again:
41 #define VETH_DEF_NAME "eth%d"
43 static int rename_in_ns(int pid, char *oldname, char **newnamep)
45 - int fd = -1, ofd = -1, ret, ifindex = -1;
46 + uid_t ruid, suid, euid;
48 + int fd = -1, ifindex = -1, ofd = -1, ret;
49 bool grab_newname = false;
51 ofd = lxc_preserve_ns(getpid(), "net");
53 - fprintf(stderr, "Failed opening network namespace path for '%d'.", getpid());
55 + usernic_error("Failed opening network namespace path for '%d'.", getpid());
59 fd = lxc_preserve_ns(pid, "net");
61 - fprintf(stderr, "Failed opening network namespace path for '%d'.", pid);
63 + usernic_error("Failed opening network namespace path for '%d'.", pid);
64 + goto do_partial_cleanup;
67 + ret = getresuid(&ruid, &euid, &suid);
69 + usernic_error("Failed to retrieve real, effective, and saved "
72 + goto do_partial_cleanup;
75 + ret = setns(fd, CLONE_NEWNET);
79 + usernic_error("Failed to setns() to the network namespace of "
80 + "the container with PID %d: %s.\n",
81 + pid, strerror(errno));
82 + goto do_partial_cleanup;
85 - if (setns(fd, 0) < 0) {
86 - fprintf(stderr, "setns to container network namespace\n");
88 + ret = setresuid(ruid, ruid, 0);
90 + usernic_error("Failed to drop privilege by setting effective "
91 + "user id and real user id to %d, and saved user "
93 + ruid, strerror(errno));
94 + // COMMENT(brauner): It's ok to jump to do_full_cleanup here
95 + // since setresuid() will succeed when trying to set real,
96 + // effective, and saved to values they currently have.
97 + goto do_full_cleanup;
103 *newnamep = VETH_DEF_NAME;
104 - if (!(ifindex = if_nametoindex(oldname))) {
105 - fprintf(stderr, "failed to get netdev index\n");
108 + ifindex = if_nametoindex(oldname);
110 + usernic_error("Failed to get netdev index: %s.\n", strerror(errno));
111 + goto do_full_cleanup;
114 - if ((ret = lxc_netdev_rename_by_name(oldname, *newnamep)) < 0) {
115 - fprintf(stderr, "Error %d renaming netdev %s to %s in container\n", ret, oldname, *newnamep);
118 + ret = lxc_netdev_rename_by_name(oldname, *newnamep);
120 + usernic_error("Error %d renaming netdev %s to %s in container.\n", ret, oldname, *newnamep);
121 + goto do_full_cleanup;
125 - char ifname[IFNAMSIZ], *namep = ifname;
126 + char ifname[IFNAMSIZ];
127 + char *namep = ifname;
129 if (!if_indextoname(ifindex, namep)) {
130 - fprintf(stderr, "Failed to get new netdev name\n");
132 + usernic_error("Failed to get new netdev name: %s.\n", strerror(errno));
133 + goto do_full_cleanup;
136 *newnamep = strdup(namep);
139 + goto do_full_cleanup;
141 - if (setns(ofd, 0) < 0) {
142 - fprintf(stderr, "Error returning to original netns\n");
149 + ret = setresuid(ruid, euid, suid);
151 + usernic_error("Failed to restore privilege by setting effective "
152 + "user id to %d, real user id to %d, and saved user "
154 + ruid, euid, suid, strerror(errno));
156 + // COMMENT(brauner): setns() should fail if setresuid() doesn't
157 + // succeed but there's no harm in falling through; keeps the
163 + ret = setns(ofd, CLONE_NEWNET);
165 + usernic_error("Failed to setns() to original network namespace "
166 + "of PID %d: %s.\n",
167 + ofd, strerror(errno));
174 - if (setns(ofd, 0) < 0)
175 - fprintf(stderr, "Error returning to original network namespace\n");