mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-27 19:29:37 +00:00
batman-adv: allow netlink usage in unprivileged containers
[ Upstream commit 9057d6c23e
]
Currently, creating a batman-adv interface in an unprivileged LXD
container and attaching secondary interfaces to it with "ip" or "batctl"
works fine. However all batctl debug and configuration commands
fail:
root@container:~# batctl originators
Error received: Operation not permitted
root@container:~# batctl orig_interval
1000
root@container:~# batctl orig_interval 2000
root@container:~# batctl orig_interval
1000
To fix this change the generic netlink permissions from GENL_ADMIN_PERM
to GENL_UNS_ADMIN_PERM. This way a batman-adv interface is fully
maintainable as root from within a user namespace, from an unprivileged
container.
All except one batman-adv netlink setting are per interface and do not
leak information or change settings from the host system and are
therefore save to retrieve or modify as root from within an unprivileged
container.
"batctl routing_algo" / BATADV_CMD_GET_ROUTING_ALGOS is the only
exception: It provides the batman-adv kernel module wide default routing
algorithm. However it is read-only from netlink and an unprivileged
container is still not allowed to modify
/sys/module/batman_adv/parameters/routing_algo. Instead it is advised to
use the newly introduced "batctl if create routing_algo RA_NAME" /
IFLA_BATADV_ALGO_NAME to set the routing algorithm on interface
creation, which already works fine in an unprivileged container.
Cc: Tycho Andersen <tycho@tycho.pizza>
Signed-off-by: Linus Lüssing <linus.luessing@c0d3.blue>
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
parent
c93a934f81
commit
c7e4004b38
1 changed files with 15 additions and 15 deletions
|
@ -1351,21 +1351,21 @@ static const struct genl_ops batadv_netlink_ops[] = {
|
||||||
{
|
{
|
||||||
.cmd = BATADV_CMD_TP_METER,
|
.cmd = BATADV_CMD_TP_METER,
|
||||||
.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
|
.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
|
||||||
.flags = GENL_ADMIN_PERM,
|
.flags = GENL_UNS_ADMIN_PERM,
|
||||||
.doit = batadv_netlink_tp_meter_start,
|
.doit = batadv_netlink_tp_meter_start,
|
||||||
.internal_flags = BATADV_FLAG_NEED_MESH,
|
.internal_flags = BATADV_FLAG_NEED_MESH,
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
.cmd = BATADV_CMD_TP_METER_CANCEL,
|
.cmd = BATADV_CMD_TP_METER_CANCEL,
|
||||||
.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
|
.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
|
||||||
.flags = GENL_ADMIN_PERM,
|
.flags = GENL_UNS_ADMIN_PERM,
|
||||||
.doit = batadv_netlink_tp_meter_cancel,
|
.doit = batadv_netlink_tp_meter_cancel,
|
||||||
.internal_flags = BATADV_FLAG_NEED_MESH,
|
.internal_flags = BATADV_FLAG_NEED_MESH,
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
.cmd = BATADV_CMD_GET_ROUTING_ALGOS,
|
.cmd = BATADV_CMD_GET_ROUTING_ALGOS,
|
||||||
.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
|
.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
|
||||||
.flags = GENL_ADMIN_PERM,
|
.flags = GENL_UNS_ADMIN_PERM,
|
||||||
.dumpit = batadv_algo_dump,
|
.dumpit = batadv_algo_dump,
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
|
@ -1380,68 +1380,68 @@ static const struct genl_ops batadv_netlink_ops[] = {
|
||||||
{
|
{
|
||||||
.cmd = BATADV_CMD_GET_TRANSTABLE_LOCAL,
|
.cmd = BATADV_CMD_GET_TRANSTABLE_LOCAL,
|
||||||
.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
|
.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
|
||||||
.flags = GENL_ADMIN_PERM,
|
.flags = GENL_UNS_ADMIN_PERM,
|
||||||
.dumpit = batadv_tt_local_dump,
|
.dumpit = batadv_tt_local_dump,
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
.cmd = BATADV_CMD_GET_TRANSTABLE_GLOBAL,
|
.cmd = BATADV_CMD_GET_TRANSTABLE_GLOBAL,
|
||||||
.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
|
.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
|
||||||
.flags = GENL_ADMIN_PERM,
|
.flags = GENL_UNS_ADMIN_PERM,
|
||||||
.dumpit = batadv_tt_global_dump,
|
.dumpit = batadv_tt_global_dump,
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
.cmd = BATADV_CMD_GET_ORIGINATORS,
|
.cmd = BATADV_CMD_GET_ORIGINATORS,
|
||||||
.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
|
.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
|
||||||
.flags = GENL_ADMIN_PERM,
|
.flags = GENL_UNS_ADMIN_PERM,
|
||||||
.dumpit = batadv_orig_dump,
|
.dumpit = batadv_orig_dump,
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
.cmd = BATADV_CMD_GET_NEIGHBORS,
|
.cmd = BATADV_CMD_GET_NEIGHBORS,
|
||||||
.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
|
.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
|
||||||
.flags = GENL_ADMIN_PERM,
|
.flags = GENL_UNS_ADMIN_PERM,
|
||||||
.dumpit = batadv_hardif_neigh_dump,
|
.dumpit = batadv_hardif_neigh_dump,
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
.cmd = BATADV_CMD_GET_GATEWAYS,
|
.cmd = BATADV_CMD_GET_GATEWAYS,
|
||||||
.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
|
.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
|
||||||
.flags = GENL_ADMIN_PERM,
|
.flags = GENL_UNS_ADMIN_PERM,
|
||||||
.dumpit = batadv_gw_dump,
|
.dumpit = batadv_gw_dump,
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
.cmd = BATADV_CMD_GET_BLA_CLAIM,
|
.cmd = BATADV_CMD_GET_BLA_CLAIM,
|
||||||
.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
|
.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
|
||||||
.flags = GENL_ADMIN_PERM,
|
.flags = GENL_UNS_ADMIN_PERM,
|
||||||
.dumpit = batadv_bla_claim_dump,
|
.dumpit = batadv_bla_claim_dump,
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
.cmd = BATADV_CMD_GET_BLA_BACKBONE,
|
.cmd = BATADV_CMD_GET_BLA_BACKBONE,
|
||||||
.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
|
.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
|
||||||
.flags = GENL_ADMIN_PERM,
|
.flags = GENL_UNS_ADMIN_PERM,
|
||||||
.dumpit = batadv_bla_backbone_dump,
|
.dumpit = batadv_bla_backbone_dump,
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
.cmd = BATADV_CMD_GET_DAT_CACHE,
|
.cmd = BATADV_CMD_GET_DAT_CACHE,
|
||||||
.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
|
.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
|
||||||
.flags = GENL_ADMIN_PERM,
|
.flags = GENL_UNS_ADMIN_PERM,
|
||||||
.dumpit = batadv_dat_cache_dump,
|
.dumpit = batadv_dat_cache_dump,
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
.cmd = BATADV_CMD_GET_MCAST_FLAGS,
|
.cmd = BATADV_CMD_GET_MCAST_FLAGS,
|
||||||
.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
|
.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
|
||||||
.flags = GENL_ADMIN_PERM,
|
.flags = GENL_UNS_ADMIN_PERM,
|
||||||
.dumpit = batadv_mcast_flags_dump,
|
.dumpit = batadv_mcast_flags_dump,
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
.cmd = BATADV_CMD_SET_MESH,
|
.cmd = BATADV_CMD_SET_MESH,
|
||||||
.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
|
.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
|
||||||
.flags = GENL_ADMIN_PERM,
|
.flags = GENL_UNS_ADMIN_PERM,
|
||||||
.doit = batadv_netlink_set_mesh,
|
.doit = batadv_netlink_set_mesh,
|
||||||
.internal_flags = BATADV_FLAG_NEED_MESH,
|
.internal_flags = BATADV_FLAG_NEED_MESH,
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
.cmd = BATADV_CMD_SET_HARDIF,
|
.cmd = BATADV_CMD_SET_HARDIF,
|
||||||
.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
|
.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
|
||||||
.flags = GENL_ADMIN_PERM,
|
.flags = GENL_UNS_ADMIN_PERM,
|
||||||
.doit = batadv_netlink_set_hardif,
|
.doit = batadv_netlink_set_hardif,
|
||||||
.internal_flags = BATADV_FLAG_NEED_MESH |
|
.internal_flags = BATADV_FLAG_NEED_MESH |
|
||||||
BATADV_FLAG_NEED_HARDIF,
|
BATADV_FLAG_NEED_HARDIF,
|
||||||
|
@ -1457,7 +1457,7 @@ static const struct genl_ops batadv_netlink_ops[] = {
|
||||||
{
|
{
|
||||||
.cmd = BATADV_CMD_SET_VLAN,
|
.cmd = BATADV_CMD_SET_VLAN,
|
||||||
.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
|
.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
|
||||||
.flags = GENL_ADMIN_PERM,
|
.flags = GENL_UNS_ADMIN_PERM,
|
||||||
.doit = batadv_netlink_set_vlan,
|
.doit = batadv_netlink_set_vlan,
|
||||||
.internal_flags = BATADV_FLAG_NEED_MESH |
|
.internal_flags = BATADV_FLAG_NEED_MESH |
|
||||||
BATADV_FLAG_NEED_VLAN,
|
BATADV_FLAG_NEED_VLAN,
|
||||||
|
|
Loading…
Reference in a new issue