Re: [PATCH rdma-next 2/7] RDMA/uverbs: Check CAP_NET_RAW in user namespace for QP create

[Jason Gunthorpe <jgg@nvidia.com>]

On Tue, Jun 17, 2025 at 11:35:46AM +0300, Leon Romanovsky wrote:
> From: Parav Pandit <parav@nvidia.com>
> 
> Currently, the capability check is done in the default
> init_user_ns user namespace. When a process runs in a
> non default user namespace, such check fails. Due to this
> when a process is running using podman, it fails to create
> the QP.
> 
> Since the RDMA device is a resource within a network namespace,
> use the network namespace associated with the RDMA device to
> determine its owning user namespace.
> 
> Fixes: 2dee0e545894 ("IB/uverbs: Enable QP creation with a given source QP number")
> Fixes: 6d1e7ba241e9 ("IB/uverbs: Introduce create/destroy QP commands over ioctl")
> Signed-off-by: Parav Pandit <parav@nvidia.com>
> Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
> ---
>  drivers/infiniband/core/uverbs_cmd.c          | 11 +++++++----
>  drivers/infiniband/core/uverbs_std_types_qp.c |  2 +-
>  2 files changed, 8 insertions(+), 5 deletions(-)
> 
> diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
> index 08a738a2a1ff..84f9bbc781d3 100644
> --- a/drivers/infiniband/core/uverbs_cmd.c
> +++ b/drivers/infiniband/core/uverbs_cmd.c
> @@ -1312,9 +1312,6 @@ static int create_qp(struct uverbs_attr_bundle *attrs,
>  
>  	switch (cmd->qp_type) {
>  	case IB_QPT_RAW_PACKET:
> -		if (!capable(CAP_NET_RAW))
> -			return -EPERM;
> -		break;

I don't think we should do these code movements, I'm not sure we won't
create a security problem by actually creating the object and then
immediately destroying it.

Add a rdma_uattrs_has_raw_cap() and call ib_uverbs_get_ucontext_file()
to get the ->ib_device

Jason