[PATCH net] macvlan: require lower-netns admin for IFLA_MACVLAN_FLAGS

[PATCH net] macvlan: require lower-netns admin for IFLA_MACVLAN_FLAGS

[Henry Martin]

Commit 5b782a811e73 ("macvlan: require lower-netns admin for shared
port settings") added a rtnl_dev_link_net_capable() guard to
macvlan_changelink(), but only covered IFLA_MACVLAN_BC_QUEUE_LEN and
IFLA_MACVLAN_BC_CUTOFF.  The IFLA_MACVLAN_FLAGS branch performs the
same class of cross-namespace operation: in passthru mode, toggling
MACVLAN_FLAG_NOPROMISC calls dev_set_promiscuity() on the lower
device, which lives in the parent netns.

A macvlan device can be moved into a child netns owned by a child
userns; root inside that child namespace (no CAP_NET_ADMIN in the
lower device's namespace) can then flip the parent namespace
lowerdev's promiscuity counter at will.

Extend the existing guard to IFLA_MACVLAN_FLAGS.

This issue was discovered by Tencent CodeBuddy Security.

Cc: stable@vger.kernel.org
Fixes: df8ef8f3aaa6 ("macvlan: add FDB bridge ops and macvlan flags")
Signed-off-by: Henry Martin <bsdhenrymartin@gmail.com>
---
 drivers/net/macvlan.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
index afad90b9222a2..d30cffddb1e1b 100644
--- a/drivers/net/macvlan.c
+++ b/drivers/net/macvlan.c
@@ -1641,7 +1641,8 @@ static int macvlan_changelink(struct net_device *dev,
 	int ret;
 
 	if (data &&
-	    (data[IFLA_MACVLAN_BC_QUEUE_LEN] || data[IFLA_MACVLAN_BC_CUTOFF]) &&
+	    (data[IFLA_MACVLAN_BC_QUEUE_LEN] || data[IFLA_MACVLAN_BC_CUTOFF] ||
+	     data[IFLA_MACVLAN_FLAGS]) &&
 	    !rtnl_dev_link_net_capable(dev, dev_net(vlan->lowerdev))) {
 		NL_SET_ERR_MSG(extack,
 			       "Changing shared macvlan port settings requires CAP_NET_ADMIN in the lower device network namespace");
-- 
2.43.7

Re: [PATCH net] macvlan: require lower-netns admin for IFLA_MACVLAN_FLAGS

[netdev-bot+sinfo]

Hi!

This is an automated message. This series looks like a fix, but its
commit messages seem to be missing some information:

 - Whether the issue was actually triggered, or is only theoretical
   (e.g. found by code inspection). If it was triggered please include
   the symptoms, like the stack trace or error messages.

Please do not repost the series just to address the above. Instead,
reply to this email with the missing information, so that reviewers
can take it into account. If the series needs another revision for
other reasons, please include the information in the commit messages
then.

The evaluation is done by an LLM so it may be wrong, if you think
that is the case please reply and explain.