[PATCH] virtio: nsm: require CAP_SYS_ADMIN for raw messages

[PATCH] virtio: nsm: require CAP_SYS_ADMIN for raw messages

[Yousef Alhouseen]

NSM_IOCTL_RAW is documented as CAP_SYS_ADMIN-only.

/dev/nsm is mode 0666, but the ioctl handler did not check that capability.

Reject unprivileged raw messages before sending them to the device.

Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com>
---
 drivers/misc/nsm.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/misc/nsm.c b/drivers/misc/nsm.c
index e39ff0071..8153edff3 100644
--- a/drivers/misc/nsm.c
+++ b/drivers/misc/nsm.c
@@ -9,6 +9,7 @@
  * space can use to issue these commands.
  */
 
+#include <linux/capability.h>
 #include <linux/file.h>
 #include <linux/fs.h>
 #include <linux/interrupt.h>
@@ -361,6 +362,9 @@ static long nsm_dev_ioctl(struct file *file, unsigned int cmd,
 	if (cmd != NSM_IOCTL_RAW)
 		return -EINVAL;
 
+	if (!capable(CAP_SYS_ADMIN))
+		return -EPERM;
+
 	if (_IOC_SIZE(cmd) != sizeof(raw))
 		return -EINVAL;
 
-- 
2.54.0

Re: [PATCH] virtio: nsm: require CAP_SYS_ADMIN for raw messages

[Graf (AWS), Alexander]

On 24.06.26 19:36, Yousef Alhouseen wrote:
> NSM_IOCTL_RAW is documented as CAP_SYS_ADMIN-only.
>
> /dev/nsm is mode 0666, but the ioctl handler did not check that capability.
>
> Reject unprivileged raw messages before sending them to the device.
>
> Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com>


This looks like a direct duplicate of 
https://lore.kernel.org/lkml/20260621085743.76329-1-khoavna.tin.2225@gmail.com/?


Alex



Amazon Web Services Development Center Germany GmbH
Tamara-Danz-Str. 13
10243 Berlin
Geschaeftsfuehrung: Christof Hellmis, Andreas Stieger
Eingetragen am Amtsgericht Charlottenburg unter HRB 257764 B
Sitz: Berlin
Ust-ID: DE 365 538 597

Re: [PATCH] virtio: nsm: require CAP_SYS_ADMIN for raw messages

[Yousef Alhouseen]

Thanks for catching that. You are right; this duplicates the earlier patch.

Please drop this one. Sorry for the noise.

Yousef

On Thu, 25 Jun 2026 22:19:06 +0000, "Graf (AWS), Alexander"
<graf@amazon.de> wrote:
> On 24.06.26 19:36, Yousef Alhouseen wrote:
> > NSM_IOCTL_RAW is documented as CAP_SYS_ADMIN-only.
> >
> > /dev/nsm is mode 0666, but the ioctl handler did not check that capability.
> >
> > Reject unprivileged raw messages before sending them to the device.
> >
> > Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com>
>
> This looks like a direct duplicate of
> https://lore.kernel.org/lkml/20260621085743.76329-1-khoavna.tin.2225@gmail.com/?
>
> Alex
>
> Amazon Web Services Development Center Germany GmbH
> Tamara-Danz-Str. 13
> 10243 Berlin
> Geschaeftsfuehrung: Christof Hellmis, Andreas Stieger
> Eingetragen am Amtsgericht Charlottenburg unter HRB 257764 B
> Sitz: Berlin
> Ust-ID: DE 365 538 597