[PATCH 0/1] net: netdev-genl: add missing uns-admin-perm flag to BIND_TX

[PATCH 0/1] net: netdev-genl: add missing uns-admin-perm flag to BIND_TX

[Yuchao Zhang]

Hi Jakub, Donald, and netdev maintainers,

During static inspection of the netdev generic netlink family and devmem
TCP operations, we noticed an inconsistency in permission checks between
the BIND_RX and BIND_TX operations.

Problem:

The NETDEV_CMD_BIND_RX command requires CAP_NET_ADMIN within the caller's
network namespace (uns-admin-perm in netdev.yaml, mapping to
GENL_UNS_ADMIN_PERM in netdev-genl-gen.c). This ensures that only
privileged processes in the netns can bind DMA-BUFs to network receive
queues.

In contrast, NETDEV_CMD_BIND_TX was specified without any permission
flags in Documentation/netlink/specs/netdev.yaml. Consequently, the
generated C code in net/core/netdev-genl-gen.c only sets GENL_CMD_CAP_DO,
and netdev_nl_bind_tx_doit() performs no capability checks.

This allows any unprivileged local process to issue NETDEV_CMD_BIND_TX
requests to attach arbitrary DMA-BUFs as netmem TX buffers on any device
with netmem TX support, bypassing network namespace access controls.

Note that upstream deliberately relaxed bind-rx to uns-admin-perm for
non-init user namespaces in commit e302aa3d ("net: devmem: allow
bind-rx from non-init user namespaces"), while bind-tx was added in
commit 8802087d20c0 ("net: devmem: TCP tx netlink api") without any
permission flag.  This looks like an oversight in the TX API.

Fix:

Add flags: [uns-admin-perm] to the bind-tx definition in netdev.yaml,
and update netdev-genl-gen.c with GENL_UNS_ADMIN_PERM | GENL_CMD_CAP_DO,
aligning BIND_TX with the permission model of BIND_RX.

Best regards,
Yuchao Zhang

Yuchao Zhang (1):
  net: netdev-genl: add missing uns-admin-perm flag to BIND_TX operation

 Documentation/netlink/specs/netdev.yaml | 1 +
 net/core/netdev-genl-gen.c              | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

-- 
2.53.0

[PATCH 1/1] net: netdev-genl: add missing uns-admin-perm flag to BIND_TX operation

[Yuchao Zhang]

The NETDEV_CMD_BIND_RX operation correctly carries GENL_UNS_ADMIN_PERM
(uns-admin-perm in the YAML spec), requiring CAP_NET_ADMIN within the
caller's network namespace before a process may bind a DMA-BUF to a net
device's RX queues.

The companion NETDEV_CMD_BIND_TX operation for netmem TX support was
merged without any permission flag in both the YAML specification
(Documentation/netlink/specs/netdev.yaml) and the generated C code
(net/core/netdev-genl-gen.c).  As a result, any unprivileged local
process can invoke BIND_TX to bind an arbitrary DMA-BUF file descriptor
to the TX path of a netmem-TX-capable device, bypassing the access
control that protects the equivalent RX operation.

Fix by adding the uns-admin-perm flag to the bind-tx entry in the YAML
spec and the corresponding GENL_UNS_ADMIN_PERM flag to the generated
ops table, making BIND_TX consistent with BIND_RX.

Fixes: 8802087d20c0 ("net: devmem: TCP tx netlink api")
Cc: stable@vger.kernel.org
Signed-off-by: Yuchao Zhang <ndaugoing@gmail.com>
---
 Documentation/netlink/specs/netdev.yaml | 1 +
 net/core/netdev-genl-gen.c              | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/Documentation/netlink/specs/netdev.yaml b/Documentation/netlink/specs/netdev.yaml
index 3e3f03bd5c29..3e38ffc39219 100644
--- a/Documentation/netlink/specs/netdev.yaml
+++ b/Documentation/netlink/specs/netdev.yaml
@@ -851,6 +851,7 @@ operations:
       name: bind-tx
       doc: Bind dmabuf to netdev for TX
       attribute-set: dmabuf
+      flags: [uns-admin-perm]
       do:
         request:
           attributes:
diff --git a/net/core/netdev-genl-gen.c b/net/core/netdev-genl-gen.c
index f83790341eae..e243fba64312 100644
--- a/net/core/netdev-genl-gen.c
+++ b/net/core/netdev-genl-gen.c
@@ -241,7 +241,7 @@ static const struct genl_split_ops netdev_nl_ops[] = {
 		.doit		= netdev_nl_bind_tx_doit,
 		.policy		= netdev_bind_tx_nl_policy,
 		.maxattr	= NETDEV_A_DMABUF_FD,
-		.flags		= GENL_CMD_CAP_DO,
+		.flags		= GENL_UNS_ADMIN_PERM | GENL_CMD_CAP_DO,
 	},
 	{
 		.cmd		= NETDEV_CMD_QUEUE_CREATE,
-- 
2.53.0

Re: [PATCH 0/1] net: netdev-genl: add missing uns-admin-perm flag to BIND_TX

[Stanislav Fomichev]

On 09/18, Yuchao Zhang wrote:
> Hi Jakub, Donald, and netdev maintainers,
> 
> During static inspection of the netdev generic netlink family and devmem
> TCP operations, we noticed an inconsistency in permission checks between
> the BIND_RX and BIND_TX operations.

This is by design. Similar patch has been posted many times, please
search the list..

---
pw-bot: cr