[linux-next] LinuxNextTracking branch, master, updated. next-20220105 - linux-merge - lists.open-mesh.org

5 Jan 2022

The following commit has been merged in the master branch:
commit 9057d6c23e7388ee9d037fccc9a7bc8557ce277b
Author: Linus L��ssing linus.luessing@c0d3.blue
Date:   Sun Oct 31 22:30:12 2021 +0100
batman-adv: allow netlink usage in unprivileged containers
Currently, creating a batman-adv interface in an unprivileged LXD
    container and attaching secondary interfaces to it with "ip" or "batctl"
    works fine. However all batctl debug and configuration commands
    fail:
root@container:~# batctl originators
      Error received: Operation not permitted
      root@container:~# batctl orig_interval
      1000
      root@container:~# batctl orig_interval 2000
      root@container:~# batctl orig_interval
      1000
To fix this change the generic netlink permissions from GENL_ADMIN_PERM
    to GENL_UNS_ADMIN_PERM. This way a batman-adv interface is fully
    maintainable as root from within a user namespace, from an unprivileged
    container.
All except one batman-adv netlink setting are per interface and do not
    leak information or change settings from the host system and are
    therefore save to retrieve or modify as root from within an unprivileged
    container.
"batctl routing_algo" / BATADV_CMD_GET_ROUTING_ALGOS is the only
    exception: It provides the batman-adv kernel module wide default routing
    algorithm. However it is read-only from netlink and an unprivileged
    container is still not allowed to modify
    /sys/module/batman_adv/parameters/routing_algo. Instead it is advised to
    use the newly introduced "batctl if create routing_algo RA_NAME" /
    IFLA_BATADV_ALGO_NAME to set the routing algorithm on interface
    creation, which already works fine in an unprivileged container.
Cc: Tycho Andersen tycho@tycho.pizza
    Signed-off-by: Linus L��ssing linus.luessing@c0d3.blue
    Signed-off-by: Sven Eckelmann sven@narfation.org
    Signed-off-by: Simon Wunderlich sw@simonwunderlich.de

diff --git a/net/batman-adv/netlink.c b/net/batman-adv/netlink.c
index 29276284d281..00875e1d8c44 100644
--- a/net/batman-adv/netlink.c
+++ b/net/batman-adv/netlink.c
@@ -1368,21 +1368,21 @@ static const struct genl_small_ops batadv_netlink_ops[] = {
    {
    	.cmd = BATADV_CMD_TP_METER,
    	.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
-		.flags = GENL_ADMIN_PERM,
+		.flags = GENL_UNS_ADMIN_PERM,
    	.doit = batadv_netlink_tp_meter_start,
    	.internal_flags = BATADV_FLAG_NEED_MESH,
    },
    {
    	.cmd = BATADV_CMD_TP_METER_CANCEL,
    	.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
-		.flags = GENL_ADMIN_PERM,
+		.flags = GENL_UNS_ADMIN_PERM,
    	.doit = batadv_netlink_tp_meter_cancel,
    	.internal_flags = BATADV_FLAG_NEED_MESH,
    },
    {
    	.cmd = BATADV_CMD_GET_ROUTING_ALGOS,
    	.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
-		.flags = GENL_ADMIN_PERM,
+		.flags = GENL_UNS_ADMIN_PERM,
    	.dumpit = batadv_algo_dump,
    },
    {
@@ -1397,68 +1397,68 @@ static const struct genl_small_ops batadv_netlink_ops[] = {
    {
    	.cmd = BATADV_CMD_GET_TRANSTABLE_LOCAL,
    	.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
-		.flags = GENL_ADMIN_PERM,
+		.flags = GENL_UNS_ADMIN_PERM,
    	.dumpit = batadv_tt_local_dump,
    },
    {
    	.cmd = BATADV_CMD_GET_TRANSTABLE_GLOBAL,
    	.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
-		.flags = GENL_ADMIN_PERM,
+		.flags = GENL_UNS_ADMIN_PERM,
    	.dumpit = batadv_tt_global_dump,
    },
    {
    	.cmd = BATADV_CMD_GET_ORIGINATORS,
    	.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
-		.flags = GENL_ADMIN_PERM,
+		.flags = GENL_UNS_ADMIN_PERM,
    	.dumpit = batadv_orig_dump,
    },
    {
    	.cmd = BATADV_CMD_GET_NEIGHBORS,
    	.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
-		.flags = GENL_ADMIN_PERM,
+		.flags = GENL_UNS_ADMIN_PERM,
    	.dumpit = batadv_hardif_neigh_dump,
    },
    {
    	.cmd = BATADV_CMD_GET_GATEWAYS,
    	.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
-		.flags = GENL_ADMIN_PERM,
+		.flags = GENL_UNS_ADMIN_PERM,
    	.dumpit = batadv_gw_dump,
    },
    {
    	.cmd = BATADV_CMD_GET_BLA_CLAIM,
    	.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
-		.flags = GENL_ADMIN_PERM,
+		.flags = GENL_UNS_ADMIN_PERM,
    	.dumpit = batadv_bla_claim_dump,
    },
    {
    	.cmd = BATADV_CMD_GET_BLA_BACKBONE,
    	.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
-		.flags = GENL_ADMIN_PERM,
+		.flags = GENL_UNS_ADMIN_PERM,
    	.dumpit = batadv_bla_backbone_dump,
    },
    {
    	.cmd = BATADV_CMD_GET_DAT_CACHE,
    	.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
-		.flags = GENL_ADMIN_PERM,
+		.flags = GENL_UNS_ADMIN_PERM,
    	.dumpit = batadv_dat_cache_dump,
    },
    {
    	.cmd = BATADV_CMD_GET_MCAST_FLAGS,
    	.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
-		.flags = GENL_ADMIN_PERM,
+		.flags = GENL_UNS_ADMIN_PERM,
    	.dumpit = batadv_mcast_flags_dump,
    },
    {
    	.cmd = BATADV_CMD_SET_MESH,
    	.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
-		.flags = GENL_ADMIN_PERM,
+		.flags = GENL_UNS_ADMIN_PERM,
    	.doit = batadv_netlink_set_mesh,
    	.internal_flags = BATADV_FLAG_NEED_MESH,
    },
    {
    	.cmd = BATADV_CMD_SET_HARDIF,
    	.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
-		.flags = GENL_ADMIN_PERM,
+		.flags = GENL_UNS_ADMIN_PERM,
    	.doit = batadv_netlink_set_hardif,
    	.internal_flags = BATADV_FLAG_NEED_MESH |
    			  BATADV_FLAG_NEED_HARDIF,
@@ -1474,7 +1474,7 @@ static const struct genl_small_ops batadv_netlink_ops[] = {
    {
    	.cmd = BATADV_CMD_SET_VLAN,
    	.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
-		.flags = GENL_ADMIN_PERM,
+		.flags = GENL_UNS_ADMIN_PERM,
    	.doit = batadv_netlink_set_vlan,
    	.internal_flags = BATADV_FLAG_NEED_MESH |
    			  BATADV_FLAG_NEED_VLAN,
-- 
LinuxNextTracking

    