commit 3103c2f6d8a8aa60710b99ceaacc3cae4c3b72eb
author Nick Kralevich <nnk@google.com> Mon Apr 18 15:55:59 2011 -0700
committer android-merger <android-build@android.com> Wed Sep 14 06:13:46 2011 -0700
tree 88990200c05837fa26378f8af542c1f846b10373
parent 5f5d5c8cef10f28950fa108a8bd86d55f11b7ef4

do not merge: Validate sender credentials on netlink msg receive

Verify that netlink messages are actually from the kernel,
and not from a userspace program.

Change-Id: Ic6de75abc89df8969a8c4f84c06903d16208d35a

libsysutils/src/NetlinkListener.cpp

diff --git a/libsysutils/src/NetlinkListener.cpp b/libsysutils/src/NetlinkListener.cpp
index e2a354e..fb088e1 100644
--- a/libsysutils/src/NetlinkListener.cpp
+++ b/libsysutils/src/NetlinkListener.cpp
@@ -17,6 +17,7 @@
 
 #include <sys/types.h>
 #include <sys/socket.h>
+#include <linux/netlink.h>
 #include <string.h>
 
 #define LOG_TAG "NetlinkListener"
@@ -32,10 +33,32 @@
 bool NetlinkListener::onDataAvailable(SocketClient *cli)
 {
     int socket = cli->getSocket();
-    int count;
+    ssize_t count;
+    char cred_msg[CMSG_SPACE(sizeof(struct ucred))];
+    struct sockaddr_nl snl;
+    struct iovec iov = {mBuffer, sizeof(mBuffer)};
+    struct msghdr hdr = {&snl, sizeof(snl), &iov, 1, cred_msg, sizeof(cred_msg), 0};
 
-    if ((count = recv(socket, mBuffer, sizeof(mBuffer), 0)) < 0) {
-        SLOGE("recv failed (%s)", strerror(errno));
+    if ((count = recvmsg(socket, &hdr, 0)) < 0) {
+        SLOGE("recvmsg failed (%s)", strerror(errno));
+        return false;
+    }
+
+    if ((snl.nl_groups != 1) || (snl.nl_pid != 0)) {
+        SLOGE("ignoring non-kernel netlink multicast message");
+        return false;
+    }
+
+    struct cmsghdr * cmsg = CMSG_FIRSTHDR(&hdr);
+
+    if (cmsg == NULL || cmsg->cmsg_type != SCM_CREDENTIALS) {
+        SLOGE("ignoring message with no sender credentials");
+        return false;
+    }
+
+    struct ucred * cred = (struct ucred *)CMSG_DATA(cmsg);
+    if (cred->uid != 0) {
+        SLOGE("ignoring message from non-root UID %d", cred->uid);
         return false;
     }