ACK: [SRU Bionic/Focal/OEM-5.10/OEM-5.14/Hirsute/Impish/Unstable] Bluetooth: hci_ldisc: require CAP_NET_ADMIN to attach N_HCI ldisc

[Stefan Bader]

On 02.11.21 22:31, Thadeu Lima de Souza Cascardo wrote:
> BugLink: https://bugs.launchpad.net/bugs/1949516
> 
> Any unprivileged user can attach N_HCI ldisc and send packets coming from a
> virtual controller by using PTYs.
> 
> Require initial namespace CAP_NET_ADMIN to do that.
> 
> Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo at canonical.com>
> Signed-off-by: Marcel Holtmann <marcel at holtmann.org>
> (cherry picked from commit c05731d0c6bd9a625e27ea5c5157ebf1303229e0)
> Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo at canonical.com>
Acked-by: Stefan Bader <stefan.bader at canonical.com>
> ---
>   drivers/bluetooth/hci_ldisc.c | 3 +++
>   1 file changed, 3 insertions(+)
> 
> diff --git a/drivers/bluetooth/hci_ldisc.c b/drivers/bluetooth/hci_ldisc.c
> index 5ed2cfa7da1d..5e32e4d5367a 100644
> --- a/drivers/bluetooth/hci_ldisc.c
> +++ b/drivers/bluetooth/hci_ldisc.c
> @@ -479,6 +479,9 @@ static int hci_uart_tty_open(struct tty_struct *tty)
>   
>   	BT_DBG("tty %p", tty);
>   
> +	if (!capable(CAP_NET_ADMIN))
> +		return -EPERM;
> +
>   	/* Error if the tty has no write op instead of leaving an exploitable
>   	 * hole
>   	 */
> 


-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20211103/88e87fbf/attachment.sig>