Re: [PATCH net v2] gtp: Require 'CAP_NET_ADMIN' when joining the gtp multicast group

[Nicolas Dichtel <nicolas.dichtel@6wind.com>]

Le 23/10/2026 à 09:37, Anil Kaushik a écrit :
> The gtp generic netlink family sends notifications on its "gtp"
> multicast group when a PDP context is added or deleted, and for GTP-U
> echo responses. They carry the same attributes as a GETPDP reply: the
> MS and peer addresses, and the TEIDs, or the TID and the flow label.
> 
> GETPDP requires CAP_NET_ADMIN, but generic netlink lets any user join a
> multicast group by default, so an unprivileged user in the network
> namespace of the gtp device can read all of this. Found by code
> inspection.
> 
> Fix by marking the group with GENL_MCAST_CAP_NET_ADMIN, like the psample
> "packets" group. Only users with CAP_NET_ADMIN in the user namespace
> owning the network namespace can then join it.
> 
> This is still weaker than the check on GETPDP, which needs
> CAP_NET_ADMIN in the initial user namespace: in a network namespace
> owned by another user namespace, its root can join the group, but not
> use GETPDP. Genetlink has no multicast group flag for the initial user
> namespace, and ioam6 pairs its ops and its group the same way. This fix
> blocks the unprivileged users.
> 
> Tested by joining the group as root, as root without CAP_NET_ADMIN, and
> as an unprivileged user:
> 
> Before:
>   root: joined
>   root without CAP_NET_ADMIN: joined
>   nobody: joined
> 
> After:
>   root: joined
>   root without CAP_NET_ADMIN: EPERM
>   nobody: EPERM
> 
> Fixes: 50aba46c234e ("gtp: add notification mechanism")
> Signed-off-by: Anil Kaushik <anilkaushikwireless@gmail.com>

Reviewed-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>