proxmox-mirrors/mirror_iproute2
1
0
Fork 0
mirror of https://git.proxmox.com/git/mirror_iproute2 synced 2025-12-08 05:39:44 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

netns: avoid directory traversal

Browse Source 
ip netns keeps track of created namespaces with bind mounts named
/var/run/netns/<namespace>. No input sanitization is done, allowing creation and
deletion of files relatives to /var/run/netns or, if the path is non existent or
invalid, allows to create "untracked" namespaces (invisible to the tool).

This commit denies creation or deletion of namespaces with names contaning
"/" or matching exactly "." or "..".

Signed-off-by: Matteo Croce <mcroce@redhat.com>
This commit is contained in:
Matteo Croce 2017-07-20 00:36:32 +02:00 committed by Stephen Hemminger
parent b09515553f
commit 79928fd055
1 changed files with 10 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
ip/ipnetns.c
View File

@ -766,6 +766,11 @@ static int netns_monitor(int argc, char **argv)
return 0; return 0;
} }
static int invalid_name(const char *name)
{
return strchr(name, '/') || !strcmp(name, ".") || !strcmp(name, "..");
}
int do_netns(int argc, char **argv) int do_netns(int argc, char **argv)
{ {
netns_nsid_socket_init(); netns_nsid_socket_init();
@ -775,6 +780,11 @@ int do_netns(int argc, char **argv)
return netns_list(0, NULL); return netns_list(0, NULL);
} }
if (argc > 1 && invalid_name(argv[1])) {
fprintf(stderr, "Invalid netns name \"%s\"\n", argv[1]);
exit(-1);
}
if ((matches(*argv, "list") == 0) || (matches(*argv, "show") == 0) || if ((matches(*argv, "list") == 0) || (matches(*argv, "show") == 0) ||
(matches(*argv, "lst") == 0)) { (matches(*argv, "lst") == 0)) {
netns_map_init(); netns_map_init();