R0dn3yS/android_kernel_xiaomi_sm7250
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

ANDROID: net: Paranoid network.

Browse Source 
With CONFIG_ANDROID_PARANOID_NETWORK, require specific uids/gids to instantiate
network sockets.

Signed-off-by: Robert Love <rlove@google.com>

paranoid networking: Use in_egroup_p() to check group membership

The previous group_search() caused trouble for partners with module builds.
in_egroup_p() is also cleaner.

Signed-off-by: Nick Pelly <npelly@google.com>

Fix 2.6.29 build.

Signed-off-by: Arve Hjønnevåg <arve@android.com>

net: Fix compilation of the IPv6 module

Fix compilation of the IPv6 module -- current->euid does not exist anymore,
current_euid() is what needs to be used.

Signed-off-by: Steinar H. Gunderson <sesse@google.com>

net: bluetooth: Remove the AID_NET_BT* gid numbers

Removed bluetooth checks for AID_NET_BT and AID_NET_BT_ADMIN
which are not useful anymore.
This is in preparation for getting rid of all the AID_* gids.

Change-Id: I879d7181f07532784499ef152288d12a03ab6354
Signed-off-by: JP Abgrall <jpa@google.com>

[AmitP: Folded following android-4.9 commit changes into this patch
        a2624d7b9d73 ("ANDROID: Add android_aid.h")]
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
This commit is contained in:
Robert Love 2008-10-15 15:35:44 -04:00 committed by Amit Pundir
parent e7141f6843
commit bac1ef3ca9
5 changed files with 122 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
include/linux/android_aid.h Normal file
View File

@ -0,0 +1,25 @@
/* include/linux/android_aid.h
*
* Copyright (C) 2008 Google, Inc.
*
* This software is licensed under the terms of the GNU General Public
* License version 2, as published by the Free Software Foundation, and
* may be copied, distributed, and modified under those terms.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
*/
#ifndef _LINUX_ANDROID_AID_H
#define _LINUX_ANDROID_AID_H
/* AIDs that the kernel treats differently */
#define AID_OBSOLETE_000 KGIDT_INIT(3001) /* was NET_BT_ADMIN */
#define AID_OBSOLETE_001 KGIDT_INIT(3002) /* was NET_BT */
#define AID_INET KGIDT_INIT(3003)
#define AID_NET_RAW KGIDT_INIT(3004)
#endif

6
net/Kconfig
View File

@ -92,6 +92,12 @@ source "net/netlabel/Kconfig"
endif # if INET
config ANDROID_PARANOID_NETWORK
bool "Only allow certain groups to create sockets"
default y
help
none
config NETWORK_SECMARK
bool "Security Marking"
help

29
net/bluetooth/af_bluetooth.c
View File

@ -108,11 +108,40 @@ void bt_sock_unregister(int proto)
}
EXPORT_SYMBOL(bt_sock_unregister);
#ifdef CONFIG_PARANOID_NETWORK
static inline int current_has_bt_admin(void)
{
return !current_euid();
}
static inline int current_has_bt(void)
{
return current_has_bt_admin();
}
# else
static inline int current_has_bt_admin(void)
{
return 1;
}
static inline int current_has_bt(void)
{
return 1;
}
#endif
static int bt_sock_create(struct net *net, struct socket *sock, int proto,
int kern)
{
int err;
if (proto == BTPROTO_RFCOMM || proto == BTPROTO_SCO ||
proto == BTPROTO_L2CAP) {
if (!current_has_bt())
return -EPERM;
} else if (!current_has_bt_admin())
return -EPERM;
if (net != &init_net)
return -EAFNOSUPPORT;

32
net/ipv4/af_inet.c
View File

@ -123,6 +123,10 @@
#include <trace/events/sock.h>
#ifdef CONFIG_ANDROID_PARANOID_NETWORK
#include <linux/android_aid.h>
#endif
/* The inetsw table contains everything that inet_create needs to
* build a new socket.
*/
@ -240,6 +244,29 @@ out:
}
EXPORT_SYMBOL(inet_listen);
#ifdef CONFIG_ANDROID_PARANOID_NETWORK
static inline int current_has_network(void)
{
return (!current_euid() || in_egroup_p(AID_INET) ||
in_egroup_p(AID_NET_RAW));
}
static inline int current_has_cap(struct net *net, int cap)
{
if (cap == CAP_NET_RAW && in_egroup_p(AID_NET_RAW))
return 1;
return ns_capable(net->user_ns, cap);
}
# else
static inline int current_has_network(void)
{
return 1;
}
static inline int current_has_cap(struct net *net, int cap)
{
return ns_capable(net->user_ns, cap);
}
#endif
/*
* Create an inet socket.
*/
@ -258,6 +285,9 @@ static int inet_create(struct net *net, struct socket *sock, int protocol,
if (protocol < 0 || protocol >= IPPROTO_MAX)
return -EINVAL;
if (!current_has_network())
return -EACCES;
sock->state = SS_UNCONNECTED;
/* Look for the requested type/protocol pair. */
@ -307,7 +337,7 @@ lookup_protocol:
err = -EPERM;
if (sock->type == SOCK_RAW && !kern &&
!ns_capable(net->user_ns, CAP_NET_RAW))
!current_has_cap(net, CAP_NET_RAW))
goto out_rcu_unlock;
sock->ops = answer->ops;

32
net/ipv6/af_inet6.c
View File

@ -66,6 +66,10 @@
#include <linux/uaccess.h>
#include <linux/mroute6.h>
#ifdef CONFIG_ANDROID_PARANOID_NETWORK
#include <linux/android_aid.h>
#endif
#include "ip6_offload.h"
MODULE_AUTHOR("Cast of dozens");
@ -107,6 +111,29 @@ static __inline__ struct ipv6_pinfo *inet6_sk_generic(struct sock *sk)
return (struct ipv6_pinfo *)(((u8 *)sk) + offset);
}
#ifdef CONFIG_ANDROID_PARANOID_NETWORK
static inline int current_has_network(void)
{
return (!current_euid() || in_egroup_p(AID_INET) ||
in_egroup_p(AID_NET_RAW));
}
static inline int current_has_cap(struct net *net, int cap)
{
if (cap == CAP_NET_RAW && in_egroup_p(AID_NET_RAW))
return 1;
return ns_capable(net->user_ns, cap);
}
# else
static inline int current_has_network(void)
{
return 1;
}
static inline int current_has_cap(struct net *net, int cap)
{
return ns_capable(net->user_ns, cap);
}
#endif
static int inet6_create(struct net *net, struct socket *sock, int protocol,
int kern)
{
@ -122,6 +149,9 @@ static int inet6_create(struct net *net, struct socket *sock, int protocol,
if (protocol < 0 || protocol >= IPPROTO_MAX)
return -EINVAL;
if (!current_has_network())
return -EACCES;
/* Look for the requested type/protocol pair. */
lookup_protocol:
err = -ESOCKTNOSUPPORT;
@ -169,7 +199,7 @@ lookup_protocol:
err = -EPERM;
if (sock->type == SOCK_RAW && !kern &&
!ns_capable(net->user_ns, CAP_NET_RAW))
!current_has_cap(net, CAP_NET_RAW))
goto out_rcu_unlock;
sock->ops = answer->ops;