redonkable
/
remarkable-linux
1
0
Fork 0
Code Releases Activity
Fork of reMarkable kernel https://github.com/reMarkable/linux
709,696 Commits
26 Branches
0 Tags
2.7 GiB
C 97.7%
Assembly 1.6%
Makefile 0.3%
Perl 0.1%
 
 
 
 
Go to file
Kevin Cernekee 6716248721 netfilter: nfnetlink_cthelper: Add missing permission checks 
commit 4b380c42f7 upstream.

The capability check in nfnetlink_rcv() verifies that the caller
has CAP_NET_ADMIN in the namespace that "owns" the netlink socket.
However, nfnl_cthelper_list is shared by all net namespaces on the
system.  An unprivileged user can create user and net namespaces
in which he holds CAP_NET_ADMIN to bypass the netlink_net_capable()
check:

    $ nfct helper list
    nfct v1.4.4: netlink error: Operation not permitted
    $ vpnns -- nfct helper list
    {
            .name = ftp,
            .queuenum = 0,
            .l3protonum = 2,
            .l4protonum = 6,
            .priv_data_len = 24,
            .status = enabled,
    };

Add capable() checks in nfnetlink_cthelper, as this is cleaner than
trying to generalize the solution.

Signed-off-by: Kevin Cernekee <cernekee@chromium.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Acked-by: Michal Kubecek <mkubecek@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 		2018-01-31 14:03:41 +01:00
Documentation x86/pti: Document fix wrong index 2018-01-23 19:58:20 +01:00
arch MIPS: AR7: ensure the port type's FCR value is used 2018-01-23 19:58:21 +01:00
block block: don't let passthrough IO go into .make_request_fn() 2018-01-02 20:31:05 +01:00
certs License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
crypto crypto: algapi - fix NULL dereference in crypto_remove_spawns() 2018-01-17 09:45:23 +01:00
drivers net: mvpp2: do not disable GMAC padding 2018-01-23 19:58:21 +01:00
firmware License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
fs orangefs: initialize op on loop restart in orangefs_devreq_read 2018-01-31 14:03:40 +01:00
include mm, page_vma_mapped: Drop faulty pointer arithmetics in check_pte() 2018-01-23 19:58:21 +01:00
init x86/mm/pti: Add infrastructure for page table isolation 2018-01-02 20:30:56 +01:00
ipc License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
kernel workqueue: avoid hard lockups in show_workqueue_state() 2018-01-23 19:58:18 +01:00
lib x86/unwind: Rename unwinder config options to 'CONFIG_UNWINDER_*' 2017-12-25 14:26:13 +01:00
mm mm, page_alloc: fix potential false positive in __zone_watermark_ok 2018-01-31 14:03:40 +01:00
net netfilter: nfnetlink_cthelper: Add missing permission checks 2018-01-31 14:03:41 +01:00
samples samples/bpf: adjust rlimit RLIMIT_MEMLOCK for xdp1 2017-12-20 10:10:31 +01:00
scripts scripts/gdb/linux/tasks.py: fix get_thread_info 2018-01-23 19:58:17 +01:00
security security/Kconfig: Correct the Documentation reference for PTI 2018-01-17 09:45:30 +01:00
sound ALSA: hda - Apply the existing quirk to iMac 14,1 2018-01-23 19:58:12 +01:00
tools objtool: Improve error message for bad file argument 2018-01-23 19:58:13 +01:00
usr initramfs: fix initramfs rebuilds w/ compression after disabling 2017-11-03 07:39:19 -07:00
virt KVM: arm/arm64: Check pagesize when allocating a hugepage at Stage 2 2018-01-23 19:58:19 +01:00
.cocciconfig scripts: add Linux .cocciconfig for coccinelle 2016-07-22 12:13:39 +02:00
.get_maintainer.ignore Add hch to .get_maintainer.ignore 2015-08-21 14:30:10 -07:00
.gitattributes .gitattributes: set git diff driver for C source code files 2016-10-07 18:46:30 -07:00
.gitignore kbuild: Add support to generate LLVM assembly files 2017-04-25 08:13:52 +09:00
.mailmap .mailmap: Add Maciej W. Rozycki's Imagination e-mail address 2017-11-10 12:16:15 -08:00
COPYING
…
CREDITS MAINTAINERS: update TPM driver infrastructure changes 2017-11-09 17:58:40 -08:00
Kbuild License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
Kconfig License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
MAINTAINERS Merge branch 'akpm' (patches from Andrew) 2017-11-09 18:26:51 -08:00
Makefile Linux 4.14.15 2018-01-23 19:58:21 +01:00
README README: add a new README file, pointing to the Documentation/ 2016-10-24 08:12:35 -02:00

README 

Linux kernel
============

This file was moved to Documentation/admin-guide/README.rst

Please notice that there are several guides for kernel developers and users.
These guides can be rendered in a number of formats, like HTML and PDF.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.
See Documentation/00-INDEX for a list of what is contained in each file.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.