In order to keep track of created netns, 'ip netns' creates a mount
point inside NETNS_RUN_DIR. By not checking the user-specified name, it
allowed to create that mount point outside of NETNS_RUN_DIR and hence
lose track of it afterwards:
| # ip netns add ../../tmp/foobar
| # ip netns list
| # mount | grep foobar
| nsfs on /tmp/foobar type nsfs (rw)
Prevent this by making sure basename() does not see a need to alter the
given netns name.
Fixes: 0dc34c7713bb7 ("iproute2: Add processless network namespace support")
Signed-off-by: Phil Sutter <p...@nwl.cc>
---
ip/ipnetns.c | 20 ++++++++++++++++++++
1 file changed, 20 insertions(+)
diff --git a/ip/ipnetns.c b/ip/ipnetns.c
index 0b0378ab6560c..4eee85e146b3d 100644
--- a/ip/ipnetns.c
+++ b/ip/ipnetns.c
@@ -595,6 +595,21 @@ static int create_netns_dir(void)
return 0;
}
+static bool is_basename(const char *name)
+{
+ char *name_dup = strdup(name);
+ bool rc = true;
+
+ if (!name_dup)
+ return false;
+
+ if (strcmp(basename(name_dup), name))
+ rc = false;
+
+ free(name_dup);
+ return rc;
+}
+
static int netns_add(int argc, char **argv)
{
/* This function creates a new network namespace and
@@ -616,6 +631,11 @@ static int netns_add(int argc, char **argv)
}
name = argv[0];
+ if (!is_basename(name)) {
+ fprintf(stderr, "Invalid netns name: contains path
components\n");
+ return -1;
+ }
+
snprintf(netns_path, sizeof(netns_path), "%s/%s", NETNS_RUN_DIR, name);
if (create_netns_dir())
--
2.13.1
