KumiSystems/openwrtv3
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
openwrtv3/target/linux
History
Jo-Philipp Wich 442db0d6d8 kernel: deny swconfig set requests for unprivileged users 
The swconfig kernel infrastructure fails to do any permissions checks when
changing settings. As such an ordinary user account on a device with a
switch can change switch settings without any special permissions.
Routers generally have few non-admin users so this isn't a big hole, but it
is a security hole. Likely the greatest danger is for multifunction devices
which have a lot of extra daemons, compromising a low-security daemon would
allow one to modify switch settings and cause the router/switch to appear to
lock-up (or cause other sorts of troublesome nyetwork behavior).

Implement a check for CAP_NET_ADMIN in swconfig_set_attr() and deny any
requests originating from user contexts lacking this capability.

Reported-by: Elliott Mitchell <ehem+openwrt@m5p.com>
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
2016-06-11 00:53:19 +02:00
..
adm5120 adm5120: remove target specific /etc/config/system 2016-06-08 00:31:09 +02:00
adm8668 treewide: replace nbd@openwrt.org with nbd@nbd.name 2016-06-07 08:58:42 +02:00
ar7 all: drop old uci-defaults.sh 2015-12-11 15:26:06 +00:00
ar71xx ar71xx: add support for OpenEmbed SOM9331 2016-06-07 11:21:55 +02:00
arc770 arc: Build uImage as well as vmlinux output files 2016-06-05 23:23:57 +02:00
archs38 arc: Build uImage as well as vmlinux output files 2016-06-05 23:23:57 +02:00
arm64 kernel: remove bogus CONFIG_LOG_BUF_SHIFT overrides 2016-05-21 22:35:41 +02:00
at91 at91: fix SAMA5D3 subtarget 2016-04-25 14:54:07 +02:00
ath25 ath25: remove target specific /etc/config/system 2016-06-08 00:31:09 +02:00
au1000 image: fix jffs2(_nand) image generation 2015-08-05 13:55:52 +00:00
bcm53xx bcm53xx: calculate TRX CRC32 using whole kernel partition 2016-06-10 12:58:19 +02:00
brcm47xx treewide: replace nbd@openwrt.org with nbd@nbd.name 2016-06-07 08:58:42 +02:00
brcm63xx brcm63xx: improve image/Makefile 2016-06-08 09:16:37 +02:00
brcm2708 brcm2708: fix another missing kmod dependency 2016-06-09 00:14:26 +02:00
cns3xxx treewide: replace nbd@openwrt.org with nbd@nbd.name 2016-06-07 08:58:42 +02:00
gemini gemini: delete 3.18 support 2016-05-12 17:55:15 +02:00
generic kernel: deny swconfig set requests for unprivileged users 2016-06-11 00:53:19 +02:00
imx6 imx6: move profile definitions to the image/Makefile 2016-05-23 11:03:23 +02:00
ipq806x treewide: replace nbd@openwrt.org with nbd@nbd.name 2016-06-07 08:58:42 +02:00
ixp4xx ixp4xx: fix Avila SoC audio driver compilation 2016-06-07 11:15:55 +02:00
kirkwood kirkwood: install kernel binaries into bin/ for use with external storage 2016-06-07 08:58:41 +02:00
lantiq lantiq: fix image DEVICE_DTS handling, add proper default value 2016-06-07 09:42:11 +02:00
malta malta: remove NAMESPACES config symbols 2016-06-06 14:58:11 +02:00
mcs814x branding: add LEDE branding 2016-03-24 22:40:13 +01:00
mediatek treewide: replace nbd@openwrt.org with nbd@nbd.name 2016-06-07 08:58:42 +02:00
mpc85xx treewide: replace nbd@openwrt.org with nbd@nbd.name 2016-06-07 08:58:42 +02:00
mvebu mvebu: add a patch to deal with excessive latencies/delays during flash PIO command processing 2016-06-10 10:47:40 +02:00
mxs mxs: delete old kernel versions 2016-05-12 17:52:55 +02:00
netlogic base-files: remove default /etc/config/network, generate it via board.d instead 2016-01-25 16:30:41 +00:00
octeon global: change my email address 2016-05-12 03:29:36 +02:00
omap omap: switch to 4.4 2016-06-02 21:58:10 +02:00
omap24xx image / basefiles: make console password configurable 2016-04-18 21:53:07 +02:00
orion all: drop old uci-defaults.sh 2015-12-11 15:26:06 +00:00
oxnas oxnas: install kernel binaries into bin/ for use with external storage 2016-06-07 08:58:41 +02:00
ppc40x
ppc44x image / basefiles: make console password configurable 2016-04-18 21:53:07 +02:00
ramips treewide: replace nbd@openwrt.org with nbd@nbd.name 2016-06-07 08:58:42 +02:00
rb532 treewide: replace nbd@openwrt.org with nbd@nbd.name 2016-06-07 08:58:42 +02:00
realview image / basefiles: make console password configurable 2016-04-18 21:53:07 +02:00
sunxi sunxi: remove NAMESPACES config symbols 2016-06-06 14:58:11 +02:00
uml uml: revert accidentally committed change 2016-04-25 14:09:05 +02:00
x86 treewide: replace nbd@openwrt.org with nbd@nbd.name 2016-06-07 08:58:42 +02:00
xburst xburst: remove target specific /etc/config/system 2016-06-08 00:31:09 +02:00
zynq zynq: remove unneeded _DIAG and _XFRM symbols 2016-06-06 14:58:11 +02:00
Makefile