From: Jakub Kicinski <kuba@kernel.org>
To: Willem de Bruijn <willemdebruijn.kernel@gmail.com>
Cc: Wei Wang <weibunny@meta.com>,
"daniel.zahka@gmail.com" <daniel.zahka@gmail.com>,
"netdev@vger.kernel.org" <netdev@vger.kernel.org>,
David Wei <dw@davidwei.uk>, Andrew Lunn <andrew+netdev@lunn.ch>,
"David S. Miller" <davem@davemloft.net>,
Eric Dumazet <edumazet@google.com>
Subject: Re: [PATCH v2 net-next 5/9] psp: add unprivileged version of psp_device_get_locked
Date: Fri, 6 Mar 2026 13:34:52 -0800 [thread overview]
Message-ID: <20260306133452.71d27227@kernel.org> (raw)
In-Reply-To: <willemdebruijn.kernel.101ad57610d58@gmail.com>
On Wed, 04 Mar 2026 18:41:09 -0500 Willem de Bruijn wrote:
> [...]
> [...]
> [...]
> [...]
> >
> > Agree. And the current set of privileged operations should only include: dev-set, key-rotation.
> > All others should be unprivileged I think...
> > (The get-stats command which I should make sure they are called with unpriv = true. I will change that in the next version.)
> >
> > >
> > > well, now that I sent that I realize that criteria is so broad to
> > > include things like rx-assoc and tx-assoc, which obviously need to be
> > > unprivileged :(
> >
> > Yes. tx-assoc and rx-assoc are currently implemented as unprivileged. They call psp_assoc_device_get_locked() which currently calls psp_dev_check_access() with unpriv = true.
>
> Consider a more descriptive monitor than unprivileged too. As is, it's
> not clear what privilege or capability is implied.
>
> Perhaps just assoc_allowed?
Sorry for chiming in late. Maybe things would be more intuitive if
we flipped the logic and called the arg/functions "admin" instead
"unpriv" ?
next prev parent reply other threads:[~2026-03-06 21:34 UTC|newest]
Thread overview: 21+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-03-04 0:00 [PATCH v2 net-next 0/9] psp: Add support for dev-assoc/disassoc Wei Wang
2026-03-04 0:00 ` [PATCH v2 net-next 2/9] selftests/net: Export Netlink class via lib.py Wei Wang
2026-03-04 0:00 ` [PATCH v2 net-next 3/9] selftests/net: Add env for container based tests Wei Wang
2026-03-04 0:00 ` [PATCH v2 net-next 4/9] selftests/net: Add netkit container ping test Wei Wang
2026-03-04 0:00 ` [PATCH v2 net-next 5/9] psp: add unprivileged version of psp_device_get_locked Wei Wang
2026-03-04 15:00 ` Daniel Zahka
2026-03-04 16:25 ` Willem de Bruijn
2026-03-04 17:42 ` Wei Wang
2026-03-04 18:01 ` Daniel Zahka
2026-03-04 18:03 ` Daniel Zahka
2026-03-04 22:31 ` Wei Wang
2026-03-04 23:41 ` Willem de Bruijn
2026-03-06 21:34 ` Jakub Kicinski [this message]
2026-03-04 0:00 ` [PATCH v2 net-next 6/9] psp: Add new netlink cmd for dev-assoc and dev-disassoc Wei Wang
2026-03-04 15:20 ` Daniel Zahka
2026-03-04 16:17 ` Daniel Zahka
2026-03-04 17:28 ` Wei Wang
2026-03-04 0:00 ` [PATCH v2 net-next 7/9] psp: add a new netdev event for dev unregister Wei Wang
2026-03-04 0:00 ` [PATCH v2 net-next 8/9] selftests/net: Add bpf skb forwarding program Wei Wang
2026-03-04 0:00 ` [PATCH v2 net-next 9/9] selftest/net: psp: Add test for dev-assoc/disassoc Wei Wang
2026-03-06 21:53 ` Jakub Kicinski
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260306133452.71d27227@kernel.org \
--to=kuba@kernel.org \
--cc=andrew+netdev@lunn.ch \
--cc=daniel.zahka@gmail.com \
--cc=davem@davemloft.net \
--cc=dw@davidwei.uk \
--cc=edumazet@google.com \
--cc=netdev@vger.kernel.org \
--cc=weibunny@meta.com \
--cc=willemdebruijn.kernel@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.