bonding: Display LACP info only to CAP_NET_ADMIN capable user
Actor and Partner details can be accessed via proc-fs, sys-fs
entries or netlink interface. These interfaces are world readable
at this moment. The earlier patch-series made the LACP communication
secure to avoid nuisance attack from within the same L2 domain but
it did not prevent "someone unprivileged" looking at that information
on host and perform the same act.
This patch essentially avoids spitting those entries if the user
in question does not have enough privileges.
Signed-off-by: Mahesh Bandewar <maheshb@google.com>
Signed-off-by: Andy Gospodarek <gospo@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
diff --git a/drivers/net/bonding/bond_netlink.c b/drivers/net/bonding/bond_netlink.c
index 5580fcd..1bda292 100644
--- a/drivers/net/bonding/bond_netlink.c
+++ b/drivers/net/bonding/bond_netlink.c
@@ -601,19 +601,20 @@
if (BOND_MODE(bond) == BOND_MODE_8023AD) {
struct ad_info info;
- if (nla_put_u16(skb, IFLA_BOND_AD_ACTOR_SYS_PRIO,
- bond->params.ad_actor_sys_prio))
- goto nla_put_failure;
+ if (capable(CAP_NET_ADMIN)) {
+ if (nla_put_u16(skb, IFLA_BOND_AD_ACTOR_SYS_PRIO,
+ bond->params.ad_actor_sys_prio))
+ goto nla_put_failure;
- if (nla_put_u16(skb, IFLA_BOND_AD_USER_PORT_KEY,
- bond->params.ad_user_port_key))
- goto nla_put_failure;
+ if (nla_put_u16(skb, IFLA_BOND_AD_USER_PORT_KEY,
+ bond->params.ad_user_port_key))
+ goto nla_put_failure;
- if (nla_put(skb, IFLA_BOND_AD_ACTOR_SYSTEM,
- sizeof(bond->params.ad_actor_system),
- &bond->params.ad_actor_system))
- goto nla_put_failure;
-
+ if (nla_put(skb, IFLA_BOND_AD_ACTOR_SYSTEM,
+ sizeof(bond->params.ad_actor_system),
+ &bond->params.ad_actor_system))
+ goto nla_put_failure;
+ }
if (!bond_3ad_get_active_agg_info(bond, &info)) {
struct nlattr *nest;
diff --git a/drivers/net/bonding/bond_procfs.c b/drivers/net/bonding/bond_procfs.c
index e7f3047..f514fe5 100644
--- a/drivers/net/bonding/bond_procfs.c
+++ b/drivers/net/bonding/bond_procfs.c
@@ -135,27 +135,30 @@
bond->params.ad_select);
seq_printf(seq, "Aggregator selection policy (ad_select): %s\n",
optval->string);
- seq_printf(seq, "System priority: %d\n",
- BOND_AD_INFO(bond).system.sys_priority);
- seq_printf(seq, "System MAC address: %pM\n",
- &BOND_AD_INFO(bond).system.sys_mac_addr);
+ if (capable(CAP_NET_ADMIN)) {
+ seq_printf(seq, "System priority: %d\n",
+ BOND_AD_INFO(bond).system.sys_priority);
+ seq_printf(seq, "System MAC address: %pM\n",
+ &BOND_AD_INFO(bond).system.sys_mac_addr);
- if (__bond_3ad_get_active_agg_info(bond, &ad_info)) {
- seq_printf(seq, "bond %s has no active aggregator\n",
- bond->dev->name);
- } else {
- seq_printf(seq, "Active Aggregator Info:\n");
+ if (__bond_3ad_get_active_agg_info(bond, &ad_info)) {
+ seq_printf(seq,
+ "bond %s has no active aggregator\n",
+ bond->dev->name);
+ } else {
+ seq_printf(seq, "Active Aggregator Info:\n");
- seq_printf(seq, "\tAggregator ID: %d\n",
- ad_info.aggregator_id);
- seq_printf(seq, "\tNumber of ports: %d\n",
- ad_info.ports);
- seq_printf(seq, "\tActor Key: %d\n",
- ad_info.actor_key);
- seq_printf(seq, "\tPartner Key: %d\n",
- ad_info.partner_key);
- seq_printf(seq, "\tPartner Mac Address: %pM\n",
- ad_info.partner_system);
+ seq_printf(seq, "\tAggregator ID: %d\n",
+ ad_info.aggregator_id);
+ seq_printf(seq, "\tNumber of ports: %d\n",
+ ad_info.ports);
+ seq_printf(seq, "\tActor Key: %d\n",
+ ad_info.actor_key);
+ seq_printf(seq, "\tPartner Key: %d\n",
+ ad_info.partner_key);
+ seq_printf(seq, "\tPartner Mac Address: %pM\n",
+ ad_info.partner_system);
+ }
}
}
}
@@ -199,33 +202,35 @@
seq_printf(seq, "Partner Churned Count: %d\n",
port->churn_partner_count);
- seq_puts(seq, "details actor lacp pdu:\n");
- seq_printf(seq, " system priority: %d\n",
- port->actor_system_priority);
- seq_printf(seq, " system mac address: %pM\n",
- &port->actor_system);
- seq_printf(seq, " port key: %d\n",
- port->actor_oper_port_key);
- seq_printf(seq, " port priority: %d\n",
- port->actor_port_priority);
- seq_printf(seq, " port number: %d\n",
- port->actor_port_number);
- seq_printf(seq, " port state: %d\n",
- port->actor_oper_port_state);
+ if (capable(CAP_NET_ADMIN)) {
+ seq_puts(seq, "details actor lacp pdu:\n");
+ seq_printf(seq, " system priority: %d\n",
+ port->actor_system_priority);
+ seq_printf(seq, " system mac address: %pM\n",
+ &port->actor_system);
+ seq_printf(seq, " port key: %d\n",
+ port->actor_oper_port_key);
+ seq_printf(seq, " port priority: %d\n",
+ port->actor_port_priority);
+ seq_printf(seq, " port number: %d\n",
+ port->actor_port_number);
+ seq_printf(seq, " port state: %d\n",
+ port->actor_oper_port_state);
- seq_puts(seq, "details partner lacp pdu:\n");
- seq_printf(seq, " system priority: %d\n",
- port->partner_oper.system_priority);
- seq_printf(seq, " system mac address: %pM\n",
- &port->partner_oper.system);
- seq_printf(seq, " oper key: %d\n",
- port->partner_oper.key);
- seq_printf(seq, " port priority: %d\n",
- port->partner_oper.port_priority);
- seq_printf(seq, " port number: %d\n",
- port->partner_oper.port_number);
- seq_printf(seq, " port state: %d\n",
- port->partner_oper.port_state);
+ seq_puts(seq, "details partner lacp pdu:\n");
+ seq_printf(seq, " system priority: %d\n",
+ port->partner_oper.system_priority);
+ seq_printf(seq, " system mac address: %pM\n",
+ &port->partner_oper.system);
+ seq_printf(seq, " oper key: %d\n",
+ port->partner_oper.key);
+ seq_printf(seq, " port priority: %d\n",
+ port->partner_oper.port_priority);
+ seq_printf(seq, " port number: %d\n",
+ port->partner_oper.port_number);
+ seq_printf(seq, " port state: %d\n",
+ port->partner_oper.port_state);
+ }
} else {
seq_puts(seq, "Aggregator ID: N/A\n");
}
diff --git a/drivers/net/bonding/bond_sysfs.c b/drivers/net/bonding/bond_sysfs.c
index 143a2ab..31835a4 100644
--- a/drivers/net/bonding/bond_sysfs.c
+++ b/drivers/net/bonding/bond_sysfs.c
@@ -549,7 +549,7 @@
int count = 0;
struct bonding *bond = to_bond(d);
- if (BOND_MODE(bond) == BOND_MODE_8023AD) {
+ if (BOND_MODE(bond) == BOND_MODE_8023AD && capable(CAP_NET_ADMIN)) {
struct ad_info ad_info;
count = sprintf(buf, "%d\n",
bond_3ad_get_active_agg_info(bond, &ad_info)
@@ -569,7 +569,7 @@
int count = 0;
struct bonding *bond = to_bond(d);
- if (BOND_MODE(bond) == BOND_MODE_8023AD) {
+ if (BOND_MODE(bond) == BOND_MODE_8023AD && capable(CAP_NET_ADMIN)) {
struct ad_info ad_info;
count = sprintf(buf, "%d\n",
bond_3ad_get_active_agg_info(bond, &ad_info)
@@ -589,7 +589,7 @@
int count = 0;
struct bonding *bond = to_bond(d);
- if (BOND_MODE(bond) == BOND_MODE_8023AD) {
+ if (BOND_MODE(bond) == BOND_MODE_8023AD && capable(CAP_NET_ADMIN)) {
struct ad_info ad_info;
if (!bond_3ad_get_active_agg_info(bond, &ad_info))
count = sprintf(buf, "%pM\n", ad_info.partner_system);
@@ -698,7 +698,7 @@
{
struct bonding *bond = to_bond(d);
- if (BOND_MODE(bond) == BOND_MODE_8023AD)
+ if (BOND_MODE(bond) == BOND_MODE_8023AD && capable(CAP_NET_ADMIN))
return sprintf(buf, "%hu\n", bond->params.ad_actor_sys_prio);
return 0;
@@ -712,7 +712,7 @@
{
struct bonding *bond = to_bond(d);
- if (BOND_MODE(bond) == BOND_MODE_8023AD)
+ if (BOND_MODE(bond) == BOND_MODE_8023AD && capable(CAP_NET_ADMIN))
return sprintf(buf, "%pM\n", bond->params.ad_actor_system);
return 0;
@@ -727,7 +727,7 @@
{
struct bonding *bond = to_bond(d);
- if (BOND_MODE(bond) == BOND_MODE_8023AD)
+ if (BOND_MODE(bond) == BOND_MODE_8023AD && capable(CAP_NET_ADMIN))
return sprintf(buf, "%hu\n", bond->params.ad_user_port_key);
return 0;