bonding: Display LACP info only to CAP_NET_ADMIN capable user

Actor and Partner details can be accessed via proc-fs, sys-fs
entries or netlink interface. These interfaces are world readable
at this moment. The earlier patch-series made the LACP communication
secure to avoid nuisance attack from within the same L2 domain but
it did not prevent "someone unprivileged" looking at that information
on host and perform the same act.

This patch essentially avoids spitting those entries if the user
in question does not have enough privileges.

Signed-off-by: Mahesh Bandewar <maheshb@google.com>
Signed-off-by: Andy Gospodarek <gospo@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/drivers/net/bonding/bond_netlink.c b/drivers/net/bonding/bond_netlink.c
index 5580fcde738f9ae05e72541ec94686cd431b48b8..1bda29249d12254ddbdd2e35572597464a9380c2 100644 (file)
--- a/drivers/net/bonding/bond_netlink.c
+++ b/drivers/net/bonding/bond_netlink.c
@@ -601,19 +601,20 @@ static int bond_fill_info(struct sk_buff *skb,
        if (BOND_MODE(bond) == BOND_MODE_8023AD) {
                struct ad_info info;
 
-               if (nla_put_u16(skb, IFLA_BOND_AD_ACTOR_SYS_PRIO,
-                               bond->params.ad_actor_sys_prio))
-                       goto nla_put_failure;
-
-               if (nla_put_u16(skb, IFLA_BOND_AD_USER_PORT_KEY,
-                               bond->params.ad_user_port_key))
-                       goto nla_put_failure;
+               if (capable(CAP_NET_ADMIN)) {
+                       if (nla_put_u16(skb, IFLA_BOND_AD_ACTOR_SYS_PRIO,
+                                       bond->params.ad_actor_sys_prio))
+                               goto nla_put_failure;
 
-               if (nla_put(skb, IFLA_BOND_AD_ACTOR_SYSTEM,
-                           sizeof(bond->params.ad_actor_system),
-                           &bond->params.ad_actor_system))
-                       goto nla_put_failure;
+                       if (nla_put_u16(skb, IFLA_BOND_AD_USER_PORT_KEY,
+                                       bond->params.ad_user_port_key))
+                               goto nla_put_failure;
 
+                       if (nla_put(skb, IFLA_BOND_AD_ACTOR_SYSTEM,
+                                   sizeof(bond->params.ad_actor_system),
+                                   &bond->params.ad_actor_system))
+                               goto nla_put_failure;
+               }
                if (!bond_3ad_get_active_agg_info(bond, &info)) {
                        struct nlattr *nest;
 

diff --git a/drivers/net/bonding/bond_procfs.c b/drivers/net/bonding/bond_procfs.c
index e7f3047a26df23bcf3b50e4cc1f09a2929240764..f514fe5e80a5369a6cc8f2bf3e293a3f09cb8b4f 100644 (file)
--- a/drivers/net/bonding/bond_procfs.c
+++ b/drivers/net/bonding/bond_procfs.c
@@ -135,27 +135,30 @@ static void bond_info_show_master(struct seq_file *seq)
                                          bond->params.ad_select);
                seq_printf(seq, "Aggregator selection policy (ad_select): %s\n",
                           optval->string);
-               seq_printf(seq, "System priority: %d\n",
-                          BOND_AD_INFO(bond).system.sys_priority);
-               seq_printf(seq, "System MAC address: %pM\n",
-                          &BOND_AD_INFO(bond).system.sys_mac_addr);
-
-               if (__bond_3ad_get_active_agg_info(bond, &ad_info)) {
-                       seq_printf(seq, "bond %s has no active aggregator\n",
-                                  bond->dev->name);
-               } else {
-                       seq_printf(seq, "Active Aggregator Info:\n");
-
-                       seq_printf(seq, "\tAggregator ID: %d\n",
-                                  ad_info.aggregator_id);
-                       seq_printf(seq, "\tNumber of ports: %d\n",
-                                  ad_info.ports);
-                       seq_printf(seq, "\tActor Key: %d\n",
-                                  ad_info.actor_key);
-                       seq_printf(seq, "\tPartner Key: %d\n",
-                                  ad_info.partner_key);
-                       seq_printf(seq, "\tPartner Mac Address: %pM\n",
-                                  ad_info.partner_system);
+               if (capable(CAP_NET_ADMIN)) {
+                       seq_printf(seq, "System priority: %d\n",
+                                  BOND_AD_INFO(bond).system.sys_priority);
+                       seq_printf(seq, "System MAC address: %pM\n",
+                                  &BOND_AD_INFO(bond).system.sys_mac_addr);
+
+                       if (__bond_3ad_get_active_agg_info(bond, &ad_info)) {
+                               seq_printf(seq,
+                                          "bond %s has no active aggregator\n",
+                                          bond->dev->name);
+                       } else {
+                               seq_printf(seq, "Active Aggregator Info:\n");
+
+                               seq_printf(seq, "\tAggregator ID: %d\n",
+                                          ad_info.aggregator_id);
+                               seq_printf(seq, "\tNumber of ports: %d\n",
+                                          ad_info.ports);
+                               seq_printf(seq, "\tActor Key: %d\n",
+                                          ad_info.actor_key);
+                               seq_printf(seq, "\tPartner Key: %d\n",
+                                          ad_info.partner_key);
+                               seq_printf(seq, "\tPartner Mac Address: %pM\n",
+                                          ad_info.partner_system);
+                       }
                }
        }
 }
@@ -199,33 +202,35 @@ static void bond_info_show_slave(struct seq_file *seq,
                        seq_printf(seq, "Partner Churned Count: %d\n",
                                   port->churn_partner_count);
 
-                       seq_puts(seq, "details actor lacp pdu:\n");
-                       seq_printf(seq, "    system priority: %d\n",
-                                  port->actor_system_priority);
-                       seq_printf(seq, "    system mac address: %pM\n",
-                                  &port->actor_system);
-                       seq_printf(seq, "    port key: %d\n",
-                                  port->actor_oper_port_key);
-                       seq_printf(seq, "    port priority: %d\n",
-                                  port->actor_port_priority);
-                       seq_printf(seq, "    port number: %d\n",
-                                  port->actor_port_number);
-                       seq_printf(seq, "    port state: %d\n",
-                                  port->actor_oper_port_state);
-
-                       seq_puts(seq, "details partner lacp pdu:\n");
-                       seq_printf(seq, "    system priority: %d\n",
-                                  port->partner_oper.system_priority);
-                       seq_printf(seq, "    system mac address: %pM\n",
-                                  &port->partner_oper.system);
-                       seq_printf(seq, "    oper key: %d\n",
-                                  port->partner_oper.key);
-                       seq_printf(seq, "    port priority: %d\n",
-                                  port->partner_oper.port_priority);
-                       seq_printf(seq, "    port number: %d\n",
-                                  port->partner_oper.port_number);
-                       seq_printf(seq, "    port state: %d\n",
-                                  port->partner_oper.port_state);
+                       if (capable(CAP_NET_ADMIN)) {
+                               seq_puts(seq, "details actor lacp pdu:\n");
+                               seq_printf(seq, "    system priority: %d\n",
+                                          port->actor_system_priority);
+                               seq_printf(seq, "    system mac address: %pM\n",
+                                          &port->actor_system);
+                               seq_printf(seq, "    port key: %d\n",
+                                          port->actor_oper_port_key);
+                               seq_printf(seq, "    port priority: %d\n",
+                                          port->actor_port_priority);
+                               seq_printf(seq, "    port number: %d\n",
+                                          port->actor_port_number);
+                               seq_printf(seq, "    port state: %d\n",
+                                          port->actor_oper_port_state);
+
+                               seq_puts(seq, "details partner lacp pdu:\n");
+                               seq_printf(seq, "    system priority: %d\n",
+                                          port->partner_oper.system_priority);
+                               seq_printf(seq, "    system mac address: %pM\n",
+                                          &port->partner_oper.system);
+                               seq_printf(seq, "    oper key: %d\n",
+                                          port->partner_oper.key);
+                               seq_printf(seq, "    port priority: %d\n",
+                                          port->partner_oper.port_priority);
+                               seq_printf(seq, "    port number: %d\n",
+                                          port->partner_oper.port_number);
+                               seq_printf(seq, "    port state: %d\n",
+                                          port->partner_oper.port_state);
+                       }
                } else {
                        seq_puts(seq, "Aggregator ID: N/A\n");
                }

diff --git a/drivers/net/bonding/bond_sysfs.c b/drivers/net/bonding/bond_sysfs.c
index 143a2abd1c1cda8aae0dc61422368f3400df540f..31835a4dab5784ed11984fadbacd7f5c76fbcc8b 100644 (file)
--- a/drivers/net/bonding/bond_sysfs.c
+++ b/drivers/net/bonding/bond_sysfs.c
@@ -549,7 +549,7 @@ static ssize_t bonding_show_ad_actor_key(struct device *d,
        int count = 0;
        struct bonding *bond = to_bond(d);
 
-       if (BOND_MODE(bond) == BOND_MODE_8023AD) {
+       if (BOND_MODE(bond) == BOND_MODE_8023AD && capable(CAP_NET_ADMIN)) {
                struct ad_info ad_info;
                count = sprintf(buf, "%d\n",
                                bond_3ad_get_active_agg_info(bond, &ad_info)
@@ -569,7 +569,7 @@ static ssize_t bonding_show_ad_partner_key(struct device *d,
        int count = 0;
        struct bonding *bond = to_bond(d);
 
-       if (BOND_MODE(bond) == BOND_MODE_8023AD) {
+       if (BOND_MODE(bond) == BOND_MODE_8023AD && capable(CAP_NET_ADMIN)) {
                struct ad_info ad_info;
                count = sprintf(buf, "%d\n",
                                bond_3ad_get_active_agg_info(bond, &ad_info)
@@ -589,7 +589,7 @@ static ssize_t bonding_show_ad_partner_mac(struct device *d,
        int count = 0;
        struct bonding *bond = to_bond(d);
 
-       if (BOND_MODE(bond) == BOND_MODE_8023AD) {
+       if (BOND_MODE(bond) == BOND_MODE_8023AD && capable(CAP_NET_ADMIN)) {
                struct ad_info ad_info;
                if (!bond_3ad_get_active_agg_info(bond, &ad_info))
                        count = sprintf(buf, "%pM\n", ad_info.partner_system);
@@ -698,7 +698,7 @@ static ssize_t bonding_show_ad_actor_sys_prio(struct device *d,
 {
        struct bonding *bond = to_bond(d);
 
-       if (BOND_MODE(bond) == BOND_MODE_8023AD)
+       if (BOND_MODE(bond) == BOND_MODE_8023AD && capable(CAP_NET_ADMIN))
                return sprintf(buf, "%hu\n", bond->params.ad_actor_sys_prio);
 
        return 0;
@@ -712,7 +712,7 @@ static ssize_t bonding_show_ad_actor_system(struct device *d,
 {
        struct bonding *bond = to_bond(d);
 
-       if (BOND_MODE(bond) == BOND_MODE_8023AD)
+       if (BOND_MODE(bond) == BOND_MODE_8023AD && capable(CAP_NET_ADMIN))
                return sprintf(buf, "%pM\n", bond->params.ad_actor_system);
 
        return 0;
@@ -727,7 +727,7 @@ static ssize_t bonding_show_ad_user_port_key(struct device *d,
 {
        struct bonding *bond = to_bond(d);
 
-       if (BOND_MODE(bond) == BOND_MODE_8023AD)
+       if (BOND_MODE(bond) == BOND_MODE_8023AD && capable(CAP_NET_ADMIN))
                return sprintf(buf, "%hu\n", bond->params.ad_user_port_key);
 
        return 0;