From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pf1-f196.google.com (mail-pf1-f196.google.com [209.85.210.196]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B164A33CEA9 for ; Wed, 3 Jun 2026 14:56:43 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.196 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780498604; cv=none; b=cJnnJYsEeOEVrHBZM6ziy3dLhH2uwb51yQh4776sCVE9wXQqZiZwpJ5H1hB07YcNou+zUonS8tu5ecqqp46fJU8jB8BrAMie9FK7P0EUxuVq21uqf3Jl5BaL9oQrVkjnOrkajHL86Hf+Z9iEGfmgM6sT8dsrK6oUWm+D6uo0nJo= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780498604; c=relaxed/simple; bh=ImhruFXE9Lbro7dva4U8BROB5jOXgaN6s1GZsu01hbc=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=dNWwOllvnWiFa/AzgqcqoHpPIlO0wSsQ9UOsp0nxxOjt3FU1kUbj5GFzvdBi8djqCOiLt49jX9UscgUr8Jt20DeL7ZGw6zwWWMmN+wFYicmzjD/fFBHCnQ1lLKzMladtQsAHrRSl1NA7V8Nio0zGFM2NPtvpSg2YppEKIGcPB/0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=ZAuSxtdq; arc=none smtp.client-ip=209.85.210.196 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="ZAuSxtdq" Received: by mail-pf1-f196.google.com with SMTP id d2e1a72fcca58-842338c18e0so2602005b3a.1 for ; Wed, 03 Jun 2026 07:56:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1780498603; x=1781103403; darn=vger.kernel.org; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:from:to:cc:subject:date:message-id:reply-to; bh=zKJn4y6UdkNefa3K7Wo+4bo+F/TyK5NQRV75EX80JCY=; b=ZAuSxtdq1TIqXzqjMcFLYh/Wj2sGrWlKpfVPWxxBWA7Kc5kmv7huKVIJLidzDe62BT YvKclP7MFNUzAqrqBcWhMRHegm7tOiwkYmdswxybSB7j0bo6HYhAOiHZL8HSJTslGWfP 9SsLk1KdbIGyriJd4Wch6ouo3WOBLcP3zIWftozkZC6eHVu86CklE6Pl1bEIKC8eb7sm WjSU5GLX4YvtkrS2UcXyiA4baqnN3uvCJ7nVliRHTHXVxrFATD2Ocj/CB6wOcs//NC0Q o3FgJn0ixs4mPcZJz41iq1HVxKRQogHIAe796UexM0xaYPTDV19z5MsFty5f3fakFMku vTag== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1780498603; x=1781103403; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:x-gm-gg:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=zKJn4y6UdkNefa3K7Wo+4bo+F/TyK5NQRV75EX80JCY=; b=XEd/T5z4wJCoSVFXovvGz5eE7fnmvqL/dXBe/xannfJ7dPe78QMrN4kEtARHwmsN2L DkVxOdjWxb9AxJPgehKqd+UheQqvprCYXJcDaeunk82VEhVvfMCoaQYBhwy5KneW3mwN wNGxtwx3RziMDCefiYFlfIjKmaNWWps0JLHQWS7NtQdeXs41j/t8K2G4QzElf6OFDJcW cnvUu1bx6TFKAlOikpDJhNHHDWuCVIN1hV6obXDVKJ1AdoubnbGcWECSpsDhEU0zViMn FmP4VYX9oKC5YCM3AkkZbkBIvEceSDxzo562+SvO+43YeWpwcOqF96GsQ3Db8nhomsf0 oq9w== X-Forwarded-Encrypted: i=1; AFNElJ+J0Av23w7tijANZ3DK0N39uS0G/fUZA2qebi5NE/Hh7rFKv53Ul9IKD7p91ZearjZzpEfAwamEeXBBtCw=@vger.kernel.org X-Gm-Message-State: AOJu0YyBqbO5e9gl+5O9utZMkgvVY7f2GZDx9/31s8HtPxYZiWhsWfi0 qLc+loWE/YYOQyq56SBL2vtexR6UbEk5IcE81R4fKQQtkrN67CbXXURD X-Gm-Gg: Acq92OGP3JojOjUMjr7Z0xKC6Tv3nzAu7f4aM8XhWRTIIQpp3nnXv64Tr+9oRcrLWNO LuL9c4l6b2/HVEcvNhv76RVH6+Pct2rebeiUbBHIVedbPfBSRV+Pa1alAFiMHTStKYwzIRJs+HG 8Q9aeTE8tLJMPBPCq0fgHDMdwbVTGGrft+yYPiE3w7BbuvgNlfKdfkN9FIVL2BhryyLtlp9zaYk lgiVbS/x1E1ysUi1Vp4TA3SIULj1vGJWOJhaV8wh0921JByKydmWIMKFLz7L6Piwt6WVh2an9Bw 6RBW/3F4+FccmxVTAvKcHSu2MZh4C6XImFD1847BjIkNwW35z81EF9nk+R2SfDRfXuXB0WeXyfl BWahl4R5JMpP6MFvasuRYo2VfcIjLdaHBvKGuXtgRL+QxGNCDhf7u5ZCYebM733Q/v4FZvAC8wz PBbDY1ODwH62wBBNHyAy92r7Xe3vw= X-Received: by 2002:a05:6a00:bb01:b0:842:5a8d:303a with SMTP id d2e1a72fcca58-84284ec9692mr3998628b3a.37.1780498602943; Wed, 03 Jun 2026 07:56:42 -0700 (PDT) Received: from localhost ([2a03:2880:2ff:57::]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-84282915fe8sm3390839b3a.54.2026.06.03.07.56.41 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 03 Jun 2026 07:56:42 -0700 (PDT) Date: Wed, 3 Jun 2026 07:56:38 -0700 From: Stanislav Fomichev To: Bobby Eshleman Cc: Donald Hunter , Jakub Kicinski , "David S. Miller" , Eric Dumazet , Paolo Abeni , Simon Horman , Andrew Lunn , Shuah Khan , netdev@vger.kernel.org, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, Stanislav Fomichev , Mina Almasry , daniel@iogearbox.net, matttbe@kernel.org, petrm@nvidia.com, dw@davidwei.uk, Bobby Eshleman Subject: Re: [PATCH net-next v2 0/2] net: devmem: allow bind-rx from non-init user namespaces Message-ID: References: <20260602-nl-prov-v2-0-ad721142c641@meta.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: <20260602-nl-prov-v2-0-ad721142c641@meta.com> On 06/02, Bobby Eshleman wrote: > NETDEV_CMD_BIND_RX is GENL_ADMIN_PERM, which checks CAP_NET_ADMIN > against init_user_ns. With netkit and netns support for devmem, it is > now useful to let workloads holding CAP_NET_ADMIN only in their own > user_ns issue bind-rx for a netns owned by that user_ns. > > The first patch switches the flag to GENL_UNS_ADMIN_PERM so the check > uses the target netns's owning user_ns. Init remains permitted. > > The second patch just adds test cases. They are identical to > nk_devmem.py tests, but using a non-init userns. > > Signed-off-by: Bobby Eshleman > --- > Changes in v2: > - some pylint fixes > - fixed import issue > - Link to v1: https://lore.kernel.org/all/20260601-nl-prov-v1-0-9bc57d6ca3f3@meta.com/ Acked-by: Stanislav Fomichev