| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
handshake: Require admin permission for DONE command [ Upstream commit 81246a65303d9635266b1334490142caaf86a11f ] ACCEPT and DONE are the two downcalls of the handshake genl family, both intended for use by the trusted handshake agent (tlshd). ACCEPT already requires GENL_ADMIN_PERM; DONE has no privilege check at all. The fd-lookup in handshake_nl_done_doit() only confirms that some pending handshake request exists for the supplied sockfd; it does not authenticate the sender. An unprivileged process that guesses or observes a valid sockfd can therefore submit a DONE with HANDSHAKE_A_DONE_STATUS == 0, leaving the kernel consumer to proceed as if the handshake succeeded. A non-zero status on a forged DONE tears down a legitimate in-flight handshake before tlshd can report its real result. Fixes: 3b3009ea8abb ("net/handshake: Create a NETLINK service for handling handshake requests") Reviewed-by: Jeff Layton <jlayton@kernel.org> Reviewed-by: Hannes Reinecke <hare@kernel.org> Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Link: https://patch.msgid.link/20260609141831.90694-1-cel@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org> (cherry picked from commit 25fb53e43ec006ac69b9e825a7e8a11d63a6083e) Signed-off-by: Wentao Guan <guanwentao@uniontech.com> | 1 个月前 | |
doc/netlink: Fix typo in genetlink-* schemas Fix typo verion -> version in genetlink-c and genetlink-legacy. Signed-off-by: Donald Hunter <donald.hunter@gmail.com> Reviewed-by: Jacob Keller <jacob.e.keller@intel.com> Link: https://lore.kernel.org/r/20230825122756.7603-2-donald.hunter@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> | 2 年前 | |
doc/netlink: Fix typo in genetlink-* schemas Fix typo verion -> version in genetlink-c and genetlink-legacy. Signed-off-by: Donald Hunter <donald.hunter@gmail.com> Reviewed-by: Jacob Keller <jacob.e.keller@intel.com> Link: https://lore.kernel.org/r/20230825122756.7603-2-donald.hunter@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> | 2 年前 | |
netlink: specs: add dump-strict flag for dont-validate property Allow user to specify GENL_DONT_VALIDATE_DUMP_STRICT flag for validation and add this flag to netlink spec schema. Signed-off-by: Jiri Pirko <jiri@nvidia.com> Reviewed-by: Jakub Kicinski <kuba@kernel.org> Link: https://lore.kernel.org/r/20230803111340.1074067-2-jiri@resnulli.us Signed-off-by: Jakub Kicinski <kuba@kernel.org> | 3 年前 | |
doc/netlink: Add a schema for netlink-raw families This schema is largely a copy of the genetlink-legacy schema with the following modifications: - change the schema id to netlink-raw - add a top-level protonum property, e.g. 0 (for NETLINK_ROUTE) - change the protocol enumeration to netlink-raw, removing the genetlink options. - replace doc references to generic netlink with raw netlink - add a value property to mcast-group definitions Signed-off-by: Donald Hunter <donald.hunter@gmail.com> Reviewed-by: Jacob Keller <jacob.e.keller@intel.com> Link: https://lore.kernel.org/r/20230825122756.7603-3-donald.hunter@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> | 2 年前 |
| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
| 1 个月前 | ||
| 2 年前 | ||
| 2 年前 | ||
| 3 年前 | ||
| 2 年前 |