TechPanelGM/kernel_xiaomi_sm8250
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ANDROID: fully revert ANDROID_PARANOID_NETWORK

Browse Source 
Revert "ANDROID: net: paranoid: security: Add AID_NET_RAW and AID_NET_ADMIN capability check in cap_capable()."
This reverts commit 944c75118e.

Revert "ANDROID: net: paranoid: Only NET_ADMIN is allowed to fully control TUN interfaces."
This reverts commit 6ac0eb6d0d.

Revert "ANDROID: net: paranoid: Replace AID_NET_RAW checks with capable(CAP_NET_RAW)."
This reverts commit 336442ab5c.

Revert "ANDROID: net: Paranoid network."
This reverts commit bac1ef3ca9.

Test: Results of:
  git grep 'ANDROID_PARANOID_NETWORK|[^A-Z_]AID_'
  look reasonable
Bug: 138428914
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: Ibfd6c538ca87e645ab8cf28affb40abd6be0858e
This commit is contained in:
Maciej Żenczykowski
2020-07-05 12:55:36 -07:00
committed by Hridaya Prajapati
parent c036663544
commit 315125306c
7 changed files with 4 additions and 107 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
drivers/net/tun.c
View File

@@ -2971,12 +2971,6 @@ static long __tun_chr_ioctl(struct file *file, unsigned int cmd,
int ret;
bool do_notify = false;
#ifdef CONFIG_ANDROID_PARANOID_NETWORK
if (cmd != TUNGETIFF && !capable(CAP_NET_ADMIN)) {
return -EPERM;
}
#endif
if (cmd == TUNSETIFF || cmd == TUNSETQUEUE ||
(_IOC_TYPE(cmd) == SOCK_IOC_TYPE && cmd != SIOCGSKNS)) {
if (copy_from_user(&ifr, argp, ifreq_len))

26
include/linux/android_aid.h
View File

@@ -1,26 +0,0 @@
/* include/linux/android_aid.h
*
* Copyright (C) 2008 Google, Inc.
*
* This software is licensed under the terms of the GNU General Public
* License version 2, as published by the Free Software Foundation, and
* may be copied, distributed, and modified under those terms.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
*/
#ifndef _LINUX_ANDROID_AID_H
#define _LINUX_ANDROID_AID_H
/* AIDs that the kernel treats differently */
#define AID_OBSOLETE_000 KGIDT_INIT(3001) /* was NET_BT_ADMIN */
#define AID_OBSOLETE_001 KGIDT_INIT(3002) /* was NET_BT */
#define AID_INET KGIDT_INIT(3003)
#define AID_NET_RAW KGIDT_INIT(3004)
#define AID_NET_ADMIN KGIDT_INIT(3005)
#endif

6
net/Kconfig
View File

@@ -92,12 +92,6 @@ source "net/netlabel/Kconfig"
endif # if INET
config ANDROID_PARANOID_NETWORK
bool "Only allow certain groups to create sockets"
default y
help
none
config NETWORK_SECMARK
bool "Security Marking"
help

29
net/bluetooth/af_bluetooth.c
View File

@@ -108,40 +108,11 @@ void bt_sock_unregister(int proto)
}
EXPORT_SYMBOL(bt_sock_unregister);
#ifdef CONFIG_PARANOID_NETWORK
static inline int current_has_bt_admin(void)
{
return !current_euid();
}
static inline int current_has_bt(void)
{
return current_has_bt_admin();
}
# else
static inline int current_has_bt_admin(void)
{
return 1;
}
static inline int current_has_bt(void)
{
return 1;
}
#endif
static int bt_sock_create(struct net *net, struct socket *sock, int proto,
int kern)
{
int err;
if (proto == BTPROTO_RFCOMM || proto == BTPROTO_SCO ||
proto == BTPROTO_L2CAP) {
if (!current_has_bt())
return -EPERM;
} else if (!current_has_bt_admin())
return -EPERM;
if (net != &init_net)
return -EAFNOSUPPORT;

20
net/ipv4/af_inet.c
View File

@@ -123,20 +123,6 @@
#include <trace/events/sock.h>
#ifdef CONFIG_ANDROID_PARANOID_NETWORK
#include <linux/android_aid.h>
static inline int current_has_network(void)
{
return in_egroup_p(AID_INET) || capable(CAP_NET_RAW);
}
#else
static inline int current_has_network(void)
{
return 1;
}
#endif
int sysctl_reserved_port_bind __read_mostly = 1;
/* The inetsw table contains everything that inet_create needs to
@@ -274,9 +260,6 @@ static int inet_create(struct net *net, struct socket *sock, int protocol,
if (protocol < 0 || protocol >= IPPROTO_MAX)
return -EINVAL;
if (!current_has_network())
return -EACCES;
sock->state = SS_UNCONNECTED;
/* Look for the requested type/protocol pair. */
@@ -325,7 +308,8 @@ static int inet_create(struct net *net, struct socket *sock, int protocol,
}
err = -EPERM;
if (sock->type == SOCK_RAW && !kern && !capable(CAP_NET_RAW))
if (sock->type == SOCK_RAW && !kern &&
!ns_capable(net->user_ns, CAP_NET_RAW))
goto out_rcu_unlock;
sock->ops = answer->ops;

20
net/ipv6/af_inet6.c
View File

@@ -66,20 +66,6 @@
#include <linux/uaccess.h>
#include <linux/mroute6.h>
#ifdef CONFIG_ANDROID_PARANOID_NETWORK
#include <linux/android_aid.h>
static inline int current_has_network(void)
{
return in_egroup_p(AID_INET) || capable(CAP_NET_RAW);
}
#else
static inline int current_has_network(void)
{
return 1;
}
#endif
#include "ip6_offload.h"
MODULE_AUTHOR("Cast of dozens");
@@ -143,9 +129,6 @@ static int inet6_create(struct net *net, struct socket *sock, int protocol,
if (protocol < 0 || protocol >= IPPROTO_MAX)
return -EINVAL;
if (!current_has_network())
return -EACCES;
/* Look for the requested type/protocol pair. */
lookup_protocol:
err = -ESOCKTNOSUPPORT;
@@ -192,7 +175,8 @@ static int inet6_create(struct net *net, struct socket *sock, int protocol,
}
err = -EPERM;
if (sock->type == SOCK_RAW && !kern && !capable(CAP_NET_RAW))
if (sock->type == SOCK_RAW && !kern &&
!ns_capable(net->user_ns, CAP_NET_RAW))
goto out_rcu_unlock;
sock->ops = answer->ops;

4
security/commoncap.c
View File

@@ -31,10 +31,6 @@
#include <linux/binfmts.h>
#include <linux/personality.h>
#ifdef CONFIG_ANDROID_PARANOID_NETWORK
#include <linux/android_aid.h>
#endif
/*
* If a non-root user executes a setuid-root binary in
* !secure(SECURE_NOROOT) mode, then we raise capabilities.