From a417016d1a07e6df0621dbb2926da82642eca823 Mon Sep 17 00:00:00 2001 From: Jean Tourrilhes Date: Tue, 4 Apr 2006 15:53:43 -0700 Subject: [PATCH] wext: Fix IWENCODEEXT security permissions Check the permissions when user-space try to read the encryption parameters via SIOCGIWENCODEEXT. This is trivial and probably should go in 2.6.17... Bug was found by Brian Eaton , thanks ! Signed-off-by: Jean Tourrilhes Signed-off-by: John W. Linville --- net/core/dev.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'net/core') diff --git a/net/core/dev.c b/net/core/dev.c index 83231a2..3bad1af 100644 --- a/net/core/dev.c +++ b/net/core/dev.c @@ -2698,7 +2698,8 @@ int dev_ioctl(unsigned int cmd, void __user *arg) /* If command is `set a parameter', or * `get the encoding parameters', check if * the user has the right to do it */ - if (IW_IS_SET(cmd) || cmd == SIOCGIWENCODE) { + if (IW_IS_SET(cmd) || cmd == SIOCGIWENCODE + || cmd == SIOCGIWENCODEEXT) { if (!capable(CAP_NET_ADMIN)) return -EPERM; } -- cgit v1.1 From 848ef8555296f25d9226d3bc43ce4028835ed633 Mon Sep 17 00:00:00 2001 From: Jean Tourrilhes Date: Fri, 14 Apr 2006 10:47:26 -0700 Subject: [PATCH] wext: Fix RtNetlink ENCODE security permissions I've just realised that the RtNetlink code does not check the permission for SIOCGIWENCODE and SIOCGIWENCODEEXT, which means that any user can read the encryption keys. The fix is trivial and should go in 2.6.17 alonside the two other patch I sent you last week. Signed-off-by: Jean Tourrilhes Signed-off-by: John W. Linville --- net/core/wireless.c | 8 ++++++++ 1 file changed, 8 insertions(+) (limited to 'net/core') diff --git a/net/core/wireless.c b/net/core/wireless.c index 81d6995..d2bc72d 100644 --- a/net/core/wireless.c +++ b/net/core/wireless.c @@ -1726,6 +1726,14 @@ int wireless_rtnetlink_get(struct net_device * dev, if(!IW_IS_GET(request->cmd)) return -EOPNOTSUPP; + /* If command is `get the encoding parameters', check if + * the user has the right to do it */ + if (request->cmd == SIOCGIWENCODE || + request->cmd == SIOCGIWENCODEEXT) { + if (!capable(CAP_NET_ADMIN)) + return -EPERM; + } + /* Special cases */ if(request->cmd == SIOCGIWSTATS) /* Get Wireless Stats */ -- cgit v1.1