Re: [PATCH] drbd: don't leak the shared secret to unprivileged netlink dumps
Jens Axboe <[email protected]>
| Newsgroups | org.kernel.vger.linux-block,dev.linux.lists.drbd-dev,org.kernel.vger.linux-kernel |
|---|---|
| Message-ID | <178684599913.2049660.4334999854490321092.b4-ty@b4> |
On Fri, 14 Aug 2026 17:16:17 +0200, Christoph Böhmwalder wrote:
> The conversion to explicit netlink serialization dropped the
> exclude_sensitive parameter from net_conf_to_skb(), so each caller has
> to sanitize by hand. Two dump paths were missed:
> drbd_nl_get_connections_dumpit() and the volume-less connection branch
> of get_one_status(). Neither op carries GENL_ADMIN_PERM, so any
> unprivileged local user could read the CRAM-HMAC secret.
>
> [...]
Applied, thanks!
[1/1] drbd: don't leak the shared secret to unprivileged netlink dumps
commit: c71bf113dfdf426bdaf106636f573ef87b6613a0
Best regards,
--
Jens Axboe