|
 |
cd1737 |
From 74061958f56a4626a3a146c72f16e43012e828f1 Mon Sep 17 00:00:00 2001
|
|
|
cd1737 |
From: Phil Sutter <psutter@redhat.com>
|
|
|
cd1737 |
Date: Thu, 14 Sep 2017 15:39:23 +0200
|
|
|
cd1737 |
Subject: [PATCH] netns: avoid directory traversal
|
|
|
cd1737 |
|
|
|
cd1737 |
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1468529
|
|
|
cd1737 |
Upstream Status: iproute2.git commit 79928fd0552b5
|
|
|
cd1737 |
|
|
|
cd1737 |
commit 79928fd0552b520aa36a22e71144d10a32f7e4fe
|
|
|
cd1737 |
Author: Matteo Croce <mcroce@redhat.com>
|
|
|
cd1737 |
Date: Thu Jul 20 00:36:32 2017 +0200
|
|
|
cd1737 |
|
|
|
cd1737 |
netns: avoid directory traversal
|
|
|
cd1737 |
|
|
|
cd1737 |
ip netns keeps track of created namespaces with bind mounts named
|
|
|
cd1737 |
/var/run/netns/<namespace>. No input sanitization is done, allowing creation and
|
|
|
cd1737 |
deletion of files relatives to /var/run/netns or, if the path is non existent or
|
|
|
cd1737 |
invalid, allows to create "untracked" namespaces (invisible to the tool).
|
|
|
cd1737 |
|
|
|
cd1737 |
This commit denies creation or deletion of namespaces with names contaning
|
|
|
cd1737 |
"/" or matching exactly "." or "..".
|
|
|
cd1737 |
|
|
|
cd1737 |
Signed-off-by: Matteo Croce <mcroce@redhat.com>
|
|
|
cd1737 |
---
|
|
|
cd1737 |
ip/ipnetns.c | 10 ++++++++++
|
|
|
cd1737 |
1 file changed, 10 insertions(+)
|
|
|
cd1737 |
|
|
|
cd1737 |
diff --git a/ip/ipnetns.c b/ip/ipnetns.c
|
|
|
cd1737 |
index 0b0378a..4254994 100644
|
|
|
cd1737 |
--- a/ip/ipnetns.c
|
|
|
cd1737 |
+++ b/ip/ipnetns.c
|
|
|
cd1737 |
@@ -766,6 +766,11 @@ static int netns_monitor(int argc, char **argv)
|
|
|
cd1737 |
return 0;
|
|
|
cd1737 |
}
|
|
|
cd1737 |
|
|
|
cd1737 |
+static int invalid_name(const char *name)
|
|
|
cd1737 |
+{
|
|
|
cd1737 |
+ return strchr(name, '/') || !strcmp(name, ".") || !strcmp(name, "..");
|
|
|
cd1737 |
+}
|
|
|
cd1737 |
+
|
|
|
cd1737 |
int do_netns(int argc, char **argv)
|
|
|
cd1737 |
{
|
|
|
cd1737 |
netns_nsid_socket_init();
|
|
|
cd1737 |
@@ -775,6 +780,11 @@ int do_netns(int argc, char **argv)
|
|
|
cd1737 |
return netns_list(0, NULL);
|
|
|
cd1737 |
}
|
|
|
cd1737 |
|
|
|
cd1737 |
+ if (argc > 1 && invalid_name(argv[1])) {
|
|
|
cd1737 |
+ fprintf(stderr, "Invalid netns name \"%s\"\n", argv[1]);
|
|
|
cd1737 |
+ exit(-1);
|
|
|
cd1737 |
+ }
|
|
|
cd1737 |
+
|
|
|
cd1737 |
if ((matches(*argv, "list") == 0) || (matches(*argv, "show") == 0) ||
|
|
|
cd1737 |
(matches(*argv, "lst") == 0)) {
|
|
|
cd1737 |
netns_map_init();
|
|
|
cd1737 |
--
|
|
|
cd1737 |
1.8.3.1
|
|
|
cd1737 |
|