From 315125306c4826ecb7280bcad6a471313d1bcdd3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Maciej=20=C5=BBenczykowski?= Date: Sun, 5 Jul 2020 12:55:36 -0700 Subject: [PATCH] ANDROID: fully revert ANDROID_PARANOID_NETWORK MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Revert "ANDROID: net: paranoid: security: Add AID_NET_RAW and AID_NET_ADMIN capability check in cap_capable()." This reverts commit 944c75118e3e90cb5a6dd17fe8d7cce7e847efdb. Revert "ANDROID: net: paranoid: Only NET_ADMIN is allowed to fully control TUN interfaces." This reverts commit 6ac0eb6d0dad84c8f90fed2cedbc8bced3283a74. Revert "ANDROID: net: paranoid: Replace AID_NET_RAW checks with capable(CAP_NET_RAW)." This reverts commit 336442ab5c55790642d469da7322a8fb90ac8c1c. Revert "ANDROID: net: Paranoid network." This reverts commit bac1ef3ca905180c4fb99ebc911cad98979b8a02. Test: Results of: git grep 'ANDROID_PARANOID_NETWORK|[^A-Z_]AID_' look reasonable Bug: 138428914 Signed-off-by: Maciej Żenczykowski Change-Id: Ibfd6c538ca87e645ab8cf28affb40abd6be0858e --- drivers/net/tun.c | 6 ------ include/linux/android_aid.h | 26 -------------------------- net/Kconfig | 6 ------ net/bluetooth/af_bluetooth.c | 29 ----------------------------- net/ipv4/af_inet.c | 20 ++------------------ net/ipv6/af_inet6.c | 20 ++------------------ security/commoncap.c | 4 ---- 7 files changed, 4 insertions(+), 107 deletions(-) delete mode 100644 include/linux/android_aid.h diff --git a/drivers/net/tun.c b/drivers/net/tun.c index bd3b3ba53689..1e7f6156529d 100644 --- a/drivers/net/tun.c +++ b/drivers/net/tun.c @@ -2971,12 +2971,6 @@ static long __tun_chr_ioctl(struct file *file, unsigned int cmd, int ret; bool do_notify = false; -#ifdef CONFIG_ANDROID_PARANOID_NETWORK - if (cmd != TUNGETIFF && !capable(CAP_NET_ADMIN)) { - return -EPERM; - } -#endif - if (cmd == TUNSETIFF || cmd == TUNSETQUEUE || (_IOC_TYPE(cmd) == SOCK_IOC_TYPE && cmd != SIOCGSKNS)) { if (copy_from_user(&ifr, argp, ifreq_len)) diff --git a/include/linux/android_aid.h b/include/linux/android_aid.h deleted file mode 100644 index 3d7a5ead1200..000000000000 --- a/include/linux/android_aid.h +++ /dev/null @@ -1,26 +0,0 @@ -/* include/linux/android_aid.h - * - * Copyright (C) 2008 Google, Inc. - * - * This software is licensed under the terms of the GNU General Public - * License version 2, as published by the Free Software Foundation, and - * may be copied, distributed, and modified under those terms. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - * - */ - -#ifndef _LINUX_ANDROID_AID_H -#define _LINUX_ANDROID_AID_H - -/* AIDs that the kernel treats differently */ -#define AID_OBSOLETE_000 KGIDT_INIT(3001) /* was NET_BT_ADMIN */ -#define AID_OBSOLETE_001 KGIDT_INIT(3002) /* was NET_BT */ -#define AID_INET KGIDT_INIT(3003) -#define AID_NET_RAW KGIDT_INIT(3004) -#define AID_NET_ADMIN KGIDT_INIT(3005) - -#endif diff --git a/net/Kconfig b/net/Kconfig index fa6bc70e0e37..08ea80af0ed7 100644 --- a/net/Kconfig +++ b/net/Kconfig @@ -92,12 +92,6 @@ source "net/netlabel/Kconfig" endif # if INET -config ANDROID_PARANOID_NETWORK - bool "Only allow certain groups to create sockets" - default y - help - none - config NETWORK_SECMARK bool "Security Marking" help diff --git a/net/bluetooth/af_bluetooth.c b/net/bluetooth/af_bluetooth.c index 716828203a4d..798f8f485e5a 100644 --- a/net/bluetooth/af_bluetooth.c +++ b/net/bluetooth/af_bluetooth.c @@ -108,40 +108,11 @@ void bt_sock_unregister(int proto) } EXPORT_SYMBOL(bt_sock_unregister); -#ifdef CONFIG_PARANOID_NETWORK -static inline int current_has_bt_admin(void) -{ - return !current_euid(); -} - -static inline int current_has_bt(void) -{ - return current_has_bt_admin(); -} -# else -static inline int current_has_bt_admin(void) -{ - return 1; -} - -static inline int current_has_bt(void) -{ - return 1; -} -#endif - static int bt_sock_create(struct net *net, struct socket *sock, int proto, int kern) { int err; - if (proto == BTPROTO_RFCOMM || proto == BTPROTO_SCO || - proto == BTPROTO_L2CAP) { - if (!current_has_bt()) - return -EPERM; - } else if (!current_has_bt_admin()) - return -EPERM; - if (net != &init_net) return -EAFNOSUPPORT; diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c index 8d54635d1286..a9159c49dc24 100644 --- a/net/ipv4/af_inet.c +++ b/net/ipv4/af_inet.c @@ -123,20 +123,6 @@ #include -#ifdef CONFIG_ANDROID_PARANOID_NETWORK -#include - -static inline int current_has_network(void) -{ - return in_egroup_p(AID_INET) || capable(CAP_NET_RAW); -} -#else -static inline int current_has_network(void) -{ - return 1; -} -#endif - int sysctl_reserved_port_bind __read_mostly = 1; /* The inetsw table contains everything that inet_create needs to @@ -274,9 +260,6 @@ static int inet_create(struct net *net, struct socket *sock, int protocol, if (protocol < 0 || protocol >= IPPROTO_MAX) return -EINVAL; - if (!current_has_network()) - return -EACCES; - sock->state = SS_UNCONNECTED; /* Look for the requested type/protocol pair. */ @@ -325,7 +308,8 @@ static int inet_create(struct net *net, struct socket *sock, int protocol, } err = -EPERM; - if (sock->type == SOCK_RAW && !kern && !capable(CAP_NET_RAW)) + if (sock->type == SOCK_RAW && !kern && + !ns_capable(net->user_ns, CAP_NET_RAW)) goto out_rcu_unlock; sock->ops = answer->ops; diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c index 76d7f4537774..f480436b8433 100644 --- a/net/ipv6/af_inet6.c +++ b/net/ipv6/af_inet6.c @@ -66,20 +66,6 @@ #include #include -#ifdef CONFIG_ANDROID_PARANOID_NETWORK -#include - -static inline int current_has_network(void) -{ - return in_egroup_p(AID_INET) || capable(CAP_NET_RAW); -} -#else -static inline int current_has_network(void) -{ - return 1; -} -#endif - #include "ip6_offload.h" MODULE_AUTHOR("Cast of dozens"); @@ -143,9 +129,6 @@ static int inet6_create(struct net *net, struct socket *sock, int protocol, if (protocol < 0 || protocol >= IPPROTO_MAX) return -EINVAL; - if (!current_has_network()) - return -EACCES; - /* Look for the requested type/protocol pair. */ lookup_protocol: err = -ESOCKTNOSUPPORT; @@ -192,7 +175,8 @@ static int inet6_create(struct net *net, struct socket *sock, int protocol, } err = -EPERM; - if (sock->type == SOCK_RAW && !kern && !capable(CAP_NET_RAW)) + if (sock->type == SOCK_RAW && !kern && + !ns_capable(net->user_ns, CAP_NET_RAW)) goto out_rcu_unlock; sock->ops = answer->ops; diff --git a/security/commoncap.c b/security/commoncap.c index faff161a3b90..28b204eacc7a 100644 --- a/security/commoncap.c +++ b/security/commoncap.c @@ -31,10 +31,6 @@ #include #include -#ifdef CONFIG_ANDROID_PARANOID_NETWORK -#include -#endif - /* * If a non-root user executes a setuid-root binary in * !secure(SECURE_NOROOT) mode, then we raise capabilities.