netstack: Fix cap check around IFLA_NET_NS_FD

When bridging, or when moving a veth, we must check if we have CAP_NET_ADMIN
in the target netns.

PiperOrigin-RevId: 889518624

Author: shailend-g

pkg/sentry/socket/netstack/stack.go

@@ -23,6 +23,7 @@ import (
 	"gvisor.dev/gvisor/pkg/log"
 	"gvisor.dev/gvisor/pkg/refs"
 	"gvisor.dev/gvisor/pkg/sentry/inet"
+	"gvisor.dev/gvisor/pkg/sentry/kernel/auth"
 	"gvisor.dev/gvisor/pkg/sentry/socket/netlink/nlmsg"
 	"gvisor.dev/gvisor/pkg/syserr"
 	"gvisor.dev/gvisor/pkg/tcpip"
@@ -253,7 +254,10 @@ func (s *Stack) SetInterface(ctx context.Context, msg *nlmsg.Message) *syserr.Er
 //
 // If instead the linkAttrs map does not contain IFLA_NET_NS_FD, or if it
 // points to the same netns as the source stack, only locks the source stack
-// and returns nil. And if the netns fd is invalid, returns an error.
+// and returns nil.
+//
+// If the netns fd is invalid, or the calling context lacks CAP_NET_ADMIN,
+// returns an error.
 func (s *Stack) lockSrcAndDst(ctx context.Context, linkAttrs map[uint16]nlmsg.BytesView) (*inet.Namespace, *syserr.Error) {
 	if linkAttrs == nil {
 		s.linkMu.Lock()
@@ -273,17 +277,22 @@ func (s *Stack) lockSrcAndDst(ctx context.Context, linkAttrs map[uint16]nlmsg.By
 	if f == nil {
 		return nil, syserr.ErrInvalidArgument
 	}
-	ns, err := f(int32(fd)) // ns.DecRef() is called in unlockSrcAndDst().
+	ns, err := f(int32(fd))
 	if err != nil {
 		return nil, syserr.FromError(err)
 	}
+	if !auth.CredentialsFromContext(ctx).HasCapabilityIn(linux.CAP_NET_ADMIN, ns.UserNamespace()) {
+		ns.DecRef(ctx)
+		return nil, syserr.ErrNotPermittedNet
+	}
 
 	dst := ns.Stack().(*Stack)
 	if s == dst {
 		ns.DecRef(ctx)
 		s.linkMu.Lock()
 		return nil, nil
 	}
+	// No failures from this point on, ns.DecRef() is called in unlockSrcAndDst().
 
 	if s.id < dst.id {
 		s.linkMu.Lock()

test/rtnetlink/linux/veth_test.sh

@@ -52,3 +52,20 @@ if ! wait_for ! ip netns exec test ip link show test_veth02; then
   fail "test_veth02 hasn't been destroyed"
 fi
 ip netns del test
+
+# Test for the fact that we need CAP_NET_ADMIN in the target namespace to move a veth.
+ip netns add priv_target_ns
+unshare_status=0
+unshare -U -r -n bash -c '
+  ip link add veth_src type veth peer name veth_dst || exit 2
+  if ip link set veth_dst netns /var/run/netns/priv_target_ns 2>/dev/null; then
+    exit 1
+  fi
+  exit 0
+' || unshare_status=$?
+ip netns del priv_target_ns
+if [[ "${unshare_status}" -eq 1 ]]; then
+  fail "Move succeeded without CAP_NET_ADMIN in target"
+elif [[ "${unshare_status}" -eq 2 ]]; then
+  fail "Unexpected failure to create veth pair"
+fi