[PATCH net] macvlan: require lower-netns admin for IFLA_MACVLAN_FLAGS

[Henry Martin <bsdhenrymartin@gmail.com>]

Commit 5b782a811e73 ("macvlan: require lower-netns admin for shared
port settings") added a rtnl_dev_link_net_capable() guard to
macvlan_changelink(), but only covered IFLA_MACVLAN_BC_QUEUE_LEN and
IFLA_MACVLAN_BC_CUTOFF.  The IFLA_MACVLAN_FLAGS branch performs the
same class of cross-namespace operation: in passthru mode, toggling
MACVLAN_FLAG_NOPROMISC calls dev_set_promiscuity() on the lower
device, which lives in the parent netns.

A macvlan device can be moved into a child netns owned by a child
userns; root inside that child namespace (no CAP_NET_ADMIN in the
lower device's namespace) can then flip the parent namespace
lowerdev's promiscuity counter at will.

Extend the existing guard to IFLA_MACVLAN_FLAGS.

This issue was discovered by Tencent CodeBuddy Security.

Cc: stable@vger.kernel.org
Fixes: df8ef8f3aaa6 ("macvlan: add FDB bridge ops and macvlan flags")
Signed-off-by: Henry Martin <bsdhenrymartin@gmail.com>
---
 drivers/net/macvlan.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
index afad90b9222a2..d30cffddb1e1b 100644
--- a/drivers/net/macvlan.c
+++ b/drivers/net/macvlan.c
@@ -1641,7 +1641,8 @@ static int macvlan_changelink(struct net_device *dev,
 	int ret;
 
 	if (data &&
-	    (data[IFLA_MACVLAN_BC_QUEUE_LEN] || data[IFLA_MACVLAN_BC_CUTOFF]) &&
+	    (data[IFLA_MACVLAN_BC_QUEUE_LEN] || data[IFLA_MACVLAN_BC_CUTOFF] ||
+	     data[IFLA_MACVLAN_FLAGS]) &&
 	    !rtnl_dev_link_net_capable(dev, dev_net(vlan->lowerdev))) {
 		NL_SET_ERR_MSG(extack,
 			       "Changing shared macvlan port settings requires CAP_NET_ADMIN in the lower device network namespace");
-- 
2.43.7