[PATCH] bpf: netns: require CAP_NET_ADMIN for link targets

[Jérémy Jean]

BPF tokens allow a process to load BPF programs using CAP_NET_ADMIN in
a userns, however, netns_bpf_link_create() does not check for
CAP_NET_ADMIN in the target netns. Consequently, a token can be used
to attach a BPF program to a netns it does not control.

Require CAP_NET_ADMIN in the userns that owns the target netns for
netns BPF link creation.

Fixes: caf8f28e036c ("bpf: Add BPF token support to BPF_PROG_LOAD command")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Jérémy Jean <Jeremy.Jean@xxxxxxxxxxxxxxxxx>
---
 kernel/bpf/net_namespace.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/kernel/bpf/net_namespace.c b/kernel/bpf/net_namespace.c
index 81006a242618..0ca29c20ba85 100644
--- a/kernel/bpf/net_namespace.c
+++ b/kernel/bpf/net_namespace.c
@@ -2,6 +2,7 @@
 
 #include <linux/bpf.h>
 #include <linux/bpf-netns.h>
+#include <linux/capability.h>
 #include <linux/filter.h>
 #include <net/net_namespace.h>
 
@@ -488,6 +489,10 @@ int netns_bpf_link_create(const union bpf_attr *attr, struct bpf_prog *prog)
 	net = get_net_ns_by_fd(attr->link_create.target_fd);
 	if (IS_ERR(net))
 		return PTR_ERR(net);
+	if (!ns_capable(net->user_ns, CAP_NET_ADMIN)) {
+		err = -EPERM;
+		goto out_put_net;
+	}
 
 	net_link = kzalloc_obj(*net_link, GFP_USER);
 	if (!net_link) {
-- 
2.47.3