• Christian Brauner's avatar
    net-sysfs: add netdev_change_owner() · e6dee9f3
    Christian Brauner authored
    Add a function to change the owner of a network device when it is moved
    between network namespaces.
    
    Currently, when moving network devices between network namespaces the
    ownership of the corresponding sysfs entries is not changed. This leads
    to problems when tools try to operate on the corresponding sysfs files.
    This leads to a bug whereby a network device that is created in a
    network namespaces owned by a user namespace will have its corresponding
    sysfs entry owned by the root user of the corresponding user namespace.
    If such a network device has to be moved back to the host network
    namespace the permissions will still be set to the user namespaces. This
    means unprivileged users can e.g. trigger uevents for such incorrectly
    owned devices. They can also modify the settings of the device itself.
    Both of these things are unwanted.
    
    For example, workloads will create network devices in the host network
    namespace. Other tools will then proceed to move such devices between
    network namespaces owner by other user namespaces. While the ownership
    of the device itself is updated in
    net/core/net-sysfs.c:dev_change_net_namespace() the corresponding sysfs
    entry for the device is not:
    
    drwxr-xr-x 5 nobody nobody    0 Jan 25 18:08 .
    drwxr-xr-x 9 nobody nobody    0 Jan 25 18:08 ..
    -r--r--r-- 1 nobody nobody 4096 Jan 25 18:09 addr_assign_type
    -r--r--r-- 1 nobody nobody 4096 Jan 25 18:09 addr_len
    -r--r--r-- 1 nobody nobody 4096 Jan 25 18:09 address
    -r--r--r-- 1 nobody nobody 4096 Jan 25 18:09 broadcast
    -rw-r--r-- 1 nobody nobody 4096 Jan 25 18:09 carrier
    -r--r--r-- 1 nobody nobody 4096 Jan 25 18:09 carrier_changes
    -r--r--r-- 1 nobody nobody 4096 Jan 25 18:09 carrier_down_count
    -r--r--r-- 1 nobody nobody 4096 Jan 25 18:09 carrier_up_count
    -r--r--r-- 1 nobody nobody 4096 Jan 25 18:09 dev_id
    -r--r--r-- 1 nobody nobody 4096 Jan 25 18:09 dev_port
    -r--r--r-- 1 nobody nobody 4096 Jan 25 18:09 dormant
    -r--r--r-- 1 nobody nobody 4096 Jan 25 18:09 duplex
    -rw-r--r-- 1 nobody nobody 4096 Jan 25 18:09 flags
    -rw-r--r-- 1 nobody nobody 4096 Jan 25 18:09 gro_flush_timeout
    -rw-r--r-- 1 nobody nobody 4096 Jan 25 18:09 ifalias
    -r--r--r-- 1 nobody nobody 4096 Jan 25 18:09 ifindex
    -r--r--r-- 1 nobody nobody 4096 Jan 25 18:09 iflink
    -r--r--r-- 1 nobody nobody 4096 Jan 25 18:09 link_mode
    -rw-r--r-- 1 nobody nobody 4096 Jan 25 18:09 mtu
    -r--r--r-- 1 nobody nobody 4096 Jan 25 18:09 name_assign_type
    -rw-r--r-- 1 nobody nobody 4096 Jan 25 18:09 netdev_group
    -r--r--r-- 1 nobody nobody 4096 Jan 25 18:09 operstate
    -r--r--r-- 1 nobody nobody 4096 Jan 25 18:09 phys_port_id
    -r--r--r-- 1 nobody nobody 4096 Jan 25 18:09 phys_port_name
    -r--r--r-- 1 nobody nobody 4096 Jan 25 18:09 phys_switch_id
    drwxr-xr-x 2 nobody nobody    0 Jan 25 18:09 power
    -rw-r--r-- 1 nobody nobody 4096 Jan 25 18:09 proto_down
    drwxr-xr-x 4 nobody nobody    0 Jan 25 18:09 queues
    -r--r--r-- 1 nobody nobody 4096 Jan 25 18:09 speed
    drwxr-xr-x 2 nobody nobody    0 Jan 25 18:09 statistics
    lrwxrwxrwx 1 nobody nobody    0 Jan 25 18:08 subsystem -> ../../../../class/net
    -rw-r--r-- 1 nobody nobody 4096 Jan 25 18:09 tx_queue_len
    -r--r--r-- 1 nobody nobody 4096 Jan 25 18:09 type
    -rw-r--r-- 1 nobody nobody 4096 Jan 25 18:08 uevent
    
    However, if a device is created directly in the network namespace then
    the device's sysfs permissions will be correctly updated:
    
    drwxr-xr-x 5 root   root      0 Jan 25 18:12 .
    drwxr-xr-x 9 nobody nobody    0 Jan 25 18:08 ..
    -r--r--r-- 1 root   root   4096 Jan 25 18:12 addr_assign_type
    -r--r--r-- 1 root   root   4096 Jan 25 18:12 addr_len
    -r--r--r-- 1 root   root   4096 Jan 25 18:12 address
    -r--r--r-- 1 root   root   4096 Jan 25 18:12 broadcast
    -rw-r--r-- 1 root   root   4096 Jan 25 18:12 carrier
    -r--r--r-- 1 root   root   4096 Jan 25 18:12 carrier_changes
    -r--r--r-- 1 root   root   4096 Jan 25 18:12 carrier_down_count
    -r--r--r-- 1 root   root   4096 Jan 25 18:12 carrier_up_count
    -r--r--r-- 1 root   root   4096 Jan 25 18:12 dev_id
    -r--r--r-- 1 root   root   4096 Jan 25 18:12 dev_port
    -r--r--r-- 1 root   root   4096 Jan 25 18:12 dormant
    -r--r--r-- 1 root   root   4096 Jan 25 18:12 duplex
    -rw-r--r-- 1 root   root   4096 Jan 25 18:12 flags
    -rw-r--r-- 1 root   root   4096 Jan 25 18:12 gro_flush_timeout
    -rw-r--r-- 1 root   root   4096 Jan 25 18:12 ifalias
    -r--r--r-- 1 root   root   4096 Jan 25 18:12 ifindex
    -r--r--r-- 1 root   root   4096 Jan 25 18:12 iflink
    -r--r--r-- 1 root   root   4096 Jan 25 18:12 link_mode
    -rw-r--r-- 1 root   root   4096 Jan 25 18:12 mtu
    -r--r--r-- 1 root   root   4096 Jan 25 18:12 name_assign_type
    -rw-r--r-- 1 root   root   4096 Jan 25 18:12 netdev_group
    -r--r--r-- 1 root   root   4096 Jan 25 18:12 operstate
    -r--r--r-- 1 root   root   4096 Jan 25 18:12 phys_port_id
    -r--r--r-- 1 root   root   4096 Jan 25 18:12 phys_port_name
    -r--r--r-- 1 root   root   4096 Jan 25 18:12 phys_switch_id
    drwxr-xr-x 2 root   root      0 Jan 25 18:12 power
    -rw-r--r-- 1 root   root   4096 Jan 25 18:12 proto_down
    drwxr-xr-x 4 root   root      0 Jan 25 18:12 queues
    -r--r--r-- 1 root   root   4096 Jan 25 18:12 speed
    drwxr-xr-x 2 root   root      0 Jan 25 18:12 statistics
    lrwxrwxrwx 1 nobody nobody    0 Jan 25 18:12 subsystem -> ../../../../class/net
    -rw-r--r-- 1 root   root   4096 Jan 25 18:12 tx_queue_len
    -r--r--r-- 1 root   root   4096 Jan 25 18:12 type
    -rw-r--r-- 1 root   root   4096 Jan 25 18:12 uevent
    
    Now, when creating a network device in a network namespace owned by a
    user namespace and moving it to the host the permissions will be set to
    the id that the user namespace root user has been mapped to on the host
    leading to all sorts of permission issues:
    
    458752
    drwxr-xr-x 5 458752 458752      0 Jan 25 18:12 .
    drwxr-xr-x 9 root   root        0 Jan 25 18:08 ..
    -r--r--r-- 1 458752 458752   4096 Jan 25 18:12 addr_assign_type
    -r--r--r-- 1 458752 458752   4096 Jan 25 18:12 addr_len
    -r--r--r-- 1 458752 458752   4096 Jan 25 18:12 address
    -r--r--r-- 1 458752 458752   4096 Jan 25 18:12 broadcast
    -rw-r--r-- 1 458752 458752   4096 Jan 25 18:12 carrier
    -r--r--r-- 1 458752 458752   4096 Jan 25 18:12 carrier_changes
    -r--r--r-- 1 458752 458752   4096 Jan 25 18:12 carrier_down_count
    -r--r--r-- 1 458752 458752   4096 Jan 25 18:12 carrier_up_count
    -r--r--r-- 1 458752 458752   4096 Jan 25 18:12 dev_id
    -r--r--r-- 1 458752 458752   4096 Jan 25 18:12 dev_port
    -r--r--r-- 1 458752 458752   4096 Jan 25 18:12 dormant
    -r--r--r-- 1 458752 458752   4096 Jan 25 18:12 duplex
    -rw-r--r-- 1 458752 458752   4096 Jan 25 18:12 flags
    -rw-r--r-- 1 458752 458752   4096 Jan 25 18:12 gro_flush_timeout
    -rw-r--r-- 1 458752 458752   4096 Jan 25 18:12 ifalias
    -r--r--r-- 1 458752 458752   4096 Jan 25 18:12 ifindex
    -r--r--r-- 1 458752 458752   4096 Jan 25 18:12 iflink
    -r--r--r-- 1 458752 458752   4096 Jan 25 18:12 link_mode
    -rw-r--r-- 1 458752 458752   4096 Jan 25 18:12 mtu
    -r--r--r-- 1 458752 458752   4096 Jan 25 18:12 name_assign_type
    -rw-r--r-- 1 458752 458752   4096 Jan 25 18:12 netdev_group
    -r--r--r-- 1 458752 458752   4096 Jan 25 18:12 operstate
    -r--r--r-- 1 458752 458752   4096 Jan 25 18:12 phys_port_id
    -r--r--r-- 1 458752 458752   4096 Jan 25 18:12 phys_port_name
    -r--r--r-- 1 458752 458752   4096 Jan 25 18:12 phys_switch_id
    drwxr-xr-x 2 458752 458752      0 Jan 25 18:12 power
    -rw-r--r-- 1 458752 458752   4096 Jan 25 18:12 proto_down
    drwxr-xr-x 4 458752 458752      0 Jan 25 18:12 queues
    -r--r--r-- 1 458752 458752   4096 Jan 25 18:12 speed
    drwxr-xr-x 2 458752 458752      0 Jan 25 18:12 statistics
    lrwxrwxrwx 1 root   root        0 Jan 25 18:12 subsystem -> ../../../../class/net
    -rw-r--r-- 1 458752 458752   4096 Jan 25 18:12 tx_queue_len
    -r--r--r-- 1 458752 458752   4096 Jan 25 18:12 type
    -rw-r--r-- 1 458752 458752   4096 Jan 25 18:12 uevent
    Signed-off-by: default avatarChristian Brauner <christian.brauner@ubuntu.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    e6dee9f3
net-sysfs.h 510 Bytes