[PATCH 0/1] net: netdev-genl: add missing uns-admin-perm flag to BIND_TX

[Yuchao Zhang]

Hi Jakub, Donald, and netdev maintainers,

During static inspection of the netdev generic netlink family and devmem
TCP operations, we noticed an inconsistency in permission checks between
the BIND_RX and BIND_TX operations.

Problem:

The NETDEV_CMD_BIND_RX command requires CAP_NET_ADMIN within the caller's
network namespace (uns-admin-perm in netdev.yaml, mapping to
GENL_UNS_ADMIN_PERM in netdev-genl-gen.c). This ensures that only
privileged processes in the netns can bind DMA-BUFs to network receive
queues.

In contrast, NETDEV_CMD_BIND_TX was specified without any permission
flags in Documentation/netlink/specs/netdev.yaml. Consequently, the
generated C code in net/core/netdev-genl-gen.c only sets GENL_CMD_CAP_DO,
and netdev_nl_bind_tx_doit() performs no capability checks.

This allows any unprivileged local process to issue NETDEV_CMD_BIND_TX
requests to attach arbitrary DMA-BUFs as netmem TX buffers on any device
with netmem TX support, bypassing network namespace access controls.

Note that upstream deliberately relaxed bind-rx to uns-admin-perm for
non-init user namespaces in commit e302aa3d ("net: devmem: allow
bind-rx from non-init user namespaces"), while bind-tx was added in
commit 8802087d20c0 ("net: devmem: TCP tx netlink api") without any
permission flag.  This looks like an oversight in the TX API.

Fix:

Add flags: [uns-admin-perm] to the bind-tx definition in netdev.yaml,
and update netdev-genl-gen.c with GENL_UNS_ADMIN_PERM | GENL_CMD_CAP_DO,
aligning BIND_TX with the permission model of BIND_RX.

Best regards,
Yuchao Zhang

Yuchao Zhang (1):
  net: netdev-genl: add missing uns-admin-perm flag to BIND_TX operation

 Documentation/netlink/specs/netdev.yaml | 1 +
 net/core/netdev-genl-gen.c              | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

-- 
2.53.0