lkml.org 
[lkml]   [2022]   [Jan]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 5.16 025/217] batman-adv: allow netlink usage in unprivileged containers
    Date
    From: Linus Lüssing <linus.luessing@c0d3.blue>

    [ Upstream commit 9057d6c23e7388ee9d037fccc9a7bc8557ce277b ]

    Currently, creating a batman-adv interface in an unprivileged LXD
    container and attaching secondary interfaces to it with "ip" or "batctl"
    works fine. However all batctl debug and configuration commands
    fail:

    root@container:~# batctl originators
    Error received: Operation not permitted
    root@container:~# batctl orig_interval
    1000
    root@container:~# batctl orig_interval 2000
    root@container:~# batctl orig_interval
    1000

    To fix this change the generic netlink permissions from GENL_ADMIN_PERM
    to GENL_UNS_ADMIN_PERM. This way a batman-adv interface is fully
    maintainable as root from within a user namespace, from an unprivileged
    container.

    All except one batman-adv netlink setting are per interface and do not
    leak information or change settings from the host system and are
    therefore save to retrieve or modify as root from within an unprivileged
    container.

    "batctl routing_algo" / BATADV_CMD_GET_ROUTING_ALGOS is the only
    exception: It provides the batman-adv kernel module wide default routing
    algorithm. However it is read-only from netlink and an unprivileged
    container is still not allowed to modify
    /sys/module/batman_adv/parameters/routing_algo. Instead it is advised to
    use the newly introduced "batctl if create routing_algo RA_NAME" /
    IFLA_BATADV_ALGO_NAME to set the routing algorithm on interface
    creation, which already works fine in an unprivileged container.

    Cc: Tycho Andersen <tycho@tycho.pizza>
    Signed-off-by: Linus Lüssing <linus.luessing@c0d3.blue>
    Signed-off-by: Sven Eckelmann <sven@narfation.org>
    Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    net/batman-adv/netlink.c | 30 +++++++++++++++---------------
    1 file changed, 15 insertions(+), 15 deletions(-)

    diff --git a/net/batman-adv/netlink.c b/net/batman-adv/netlink.c
    index 29276284d281c..00875e1d8c44c 100644
    --- a/net/batman-adv/netlink.c
    +++ b/net/batman-adv/netlink.c
    @@ -1368,21 +1368,21 @@ static const struct genl_small_ops batadv_netlink_ops[] = {
    {
    .cmd = BATADV_CMD_TP_METER,
    .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
    - .flags = GENL_ADMIN_PERM,
    + .flags = GENL_UNS_ADMIN_PERM,
    .doit = batadv_netlink_tp_meter_start,
    .internal_flags = BATADV_FLAG_NEED_MESH,
    },
    {
    .cmd = BATADV_CMD_TP_METER_CANCEL,
    .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
    - .flags = GENL_ADMIN_PERM,
    + .flags = GENL_UNS_ADMIN_PERM,
    .doit = batadv_netlink_tp_meter_cancel,
    .internal_flags = BATADV_FLAG_NEED_MESH,
    },
    {
    .cmd = BATADV_CMD_GET_ROUTING_ALGOS,
    .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
    - .flags = GENL_ADMIN_PERM,
    + .flags = GENL_UNS_ADMIN_PERM,
    .dumpit = batadv_algo_dump,
    },
    {
    @@ -1397,68 +1397,68 @@ static const struct genl_small_ops batadv_netlink_ops[] = {
    {
    .cmd = BATADV_CMD_GET_TRANSTABLE_LOCAL,
    .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
    - .flags = GENL_ADMIN_PERM,
    + .flags = GENL_UNS_ADMIN_PERM,
    .dumpit = batadv_tt_local_dump,
    },
    {
    .cmd = BATADV_CMD_GET_TRANSTABLE_GLOBAL,
    .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
    - .flags = GENL_ADMIN_PERM,
    + .flags = GENL_UNS_ADMIN_PERM,
    .dumpit = batadv_tt_global_dump,
    },
    {
    .cmd = BATADV_CMD_GET_ORIGINATORS,
    .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
    - .flags = GENL_ADMIN_PERM,
    + .flags = GENL_UNS_ADMIN_PERM,
    .dumpit = batadv_orig_dump,
    },
    {
    .cmd = BATADV_CMD_GET_NEIGHBORS,
    .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
    - .flags = GENL_ADMIN_PERM,
    + .flags = GENL_UNS_ADMIN_PERM,
    .dumpit = batadv_hardif_neigh_dump,
    },
    {
    .cmd = BATADV_CMD_GET_GATEWAYS,
    .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
    - .flags = GENL_ADMIN_PERM,
    + .flags = GENL_UNS_ADMIN_PERM,
    .dumpit = batadv_gw_dump,
    },
    {
    .cmd = BATADV_CMD_GET_BLA_CLAIM,
    .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
    - .flags = GENL_ADMIN_PERM,
    + .flags = GENL_UNS_ADMIN_PERM,
    .dumpit = batadv_bla_claim_dump,
    },
    {
    .cmd = BATADV_CMD_GET_BLA_BACKBONE,
    .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
    - .flags = GENL_ADMIN_PERM,
    + .flags = GENL_UNS_ADMIN_PERM,
    .dumpit = batadv_bla_backbone_dump,
    },
    {
    .cmd = BATADV_CMD_GET_DAT_CACHE,
    .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
    - .flags = GENL_ADMIN_PERM,
    + .flags = GENL_UNS_ADMIN_PERM,
    .dumpit = batadv_dat_cache_dump,
    },
    {
    .cmd = BATADV_CMD_GET_MCAST_FLAGS,
    .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
    - .flags = GENL_ADMIN_PERM,
    + .flags = GENL_UNS_ADMIN_PERM,
    .dumpit = batadv_mcast_flags_dump,
    },
    {
    .cmd = BATADV_CMD_SET_MESH,
    .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
    - .flags = GENL_ADMIN_PERM,
    + .flags = GENL_UNS_ADMIN_PERM,
    .doit = batadv_netlink_set_mesh,
    .internal_flags = BATADV_FLAG_NEED_MESH,
    },
    {
    .cmd = BATADV_CMD_SET_HARDIF,
    .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
    - .flags = GENL_ADMIN_PERM,
    + .flags = GENL_UNS_ADMIN_PERM,
    .doit = batadv_netlink_set_hardif,
    .internal_flags = BATADV_FLAG_NEED_MESH |
    BATADV_FLAG_NEED_HARDIF,
    @@ -1474,7 +1474,7 @@ static const struct genl_small_ops batadv_netlink_ops[] = {
    {
    .cmd = BATADV_CMD_SET_VLAN,
    .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
    - .flags = GENL_ADMIN_PERM,
    + .flags = GENL_UNS_ADMIN_PERM,
    .doit = batadv_netlink_set_vlan,
    .internal_flags = BATADV_FLAG_NEED_MESH |
    BATADV_FLAG_NEED_VLAN,
    --
    2.34.1
    \
     
     \ /
      Last update: 2022-01-18 03:22    [W:4.028 / U:0.096 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site