BUG: minor net namespace information leakage of packet socket via /proc/net/ptype
From: Liu, Congyu <hidden>
Date: 2022-01-13 04:59:31
From: Liu, Congyu <hidden>
Date: 2022-01-13 04:59:31
Hello, In one net namespace, after creating a packet socket without binding it to a device, users in other net namespaces can observe the new `packet_type` added by this packet socket by reading `/proc/net/ptype` file. I believe this is related to net namespace information leakage because packet socket is net namespace aware and its `packet_type` information should not be leaked. The root cause is that function `net/core/net-procfs.c:ptype_seq_show` only checks the net namespace of `pt->dev`. It allows the `packet_type` to be shown when `pt->dev` is NULL, but does not check the net namespace of corresponding packet socket. I am very willing to work on a patch if this is confirmed as a bug, though I haven't figured out a clean way to retrieve the net namespace of corresponding packet socket via `packet_type` structure. It would be great if you could provide some feedback. Thank you! Thanks, Congyu