* [PATCH net-next] net: allow SO_MARK with CAP_NET_RAW via cmsg
@ 2022-01-31 23:33 Jakub Kicinski
2022-02-01 1:02 ` Maciej Żenczykowski
` (2 more replies)
0 siblings, 3 replies; 4+ messages in thread
From: Jakub Kicinski @ 2022-01-31 23:33 UTC (permalink / raw)
To: davem; +Cc: netdev, dsahern, edumazet, Jakub Kicinski, maze
There's not reason SO_MARK would be allowed via setsockopt()
and not via cmsg, let's keep the two consistent. See
commit 079925cce1d0 ("net: allow SO_MARK with CAP_NET_RAW")
for justification why NET_RAW -> SO_MARK is safe.
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
--
CC: maze@google.com
---
net/core/sock.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/net/core/sock.c b/net/core/sock.c
index d6804685f17f..09d31a7dc68f 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -2625,7 +2625,8 @@ int __sock_cmsg_send(struct sock *sk, struct msghdr *msg, struct cmsghdr *cmsg,
switch (cmsg->cmsg_type) {
case SO_MARK:
- if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))
+ if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_RAW) &&
+ !ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))
return -EPERM;
if (cmsg->cmsg_len != CMSG_LEN(sizeof(u32)))
return -EINVAL;
--
2.34.1
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH net-next] net: allow SO_MARK with CAP_NET_RAW via cmsg
2022-01-31 23:33 [PATCH net-next] net: allow SO_MARK with CAP_NET_RAW via cmsg Jakub Kicinski
@ 2022-02-01 1:02 ` Maciej Żenczykowski
2022-02-01 3:30 ` David Ahern
2022-02-02 4:10 ` patchwork-bot+netdevbpf
2 siblings, 0 replies; 4+ messages in thread
From: Maciej Żenczykowski @ 2022-02-01 1:02 UTC (permalink / raw)
To: Jakub Kicinski; +Cc: David S. Miller, Linux NetDev, David Ahern, Eric Dumazet
On Mon, Jan 31, 2022 at 3:34 PM Jakub Kicinski <kuba@kernel.org> wrote:
>
> There's not reason SO_MARK would be allowed via setsockopt()
> and not via cmsg, let's keep the two consistent. See
> commit 079925cce1d0 ("net: allow SO_MARK with CAP_NET_RAW")
> for justification why NET_RAW -> SO_MARK is safe.
>
> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
> --
> CC: maze@google.com
> ---
> net/core/sock.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/net/core/sock.c b/net/core/sock.c
> index d6804685f17f..09d31a7dc68f 100644
> --- a/net/core/sock.c
> +++ b/net/core/sock.c
> @@ -2625,7 +2625,8 @@ int __sock_cmsg_send(struct sock *sk, struct msghdr *msg, struct cmsghdr *cmsg,
>
> switch (cmsg->cmsg_type) {
> case SO_MARK:
> - if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))
> + if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_RAW) &&
> + !ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))
> return -EPERM;
> if (cmsg->cmsg_len != CMSG_LEN(sizeof(u32)))
> return -EINVAL;
> --
> 2.34.1
Reviewed-by: Maciej Żenczykowski <maze@google.com>
I thought I'd sent this out already... interesting must have forgotten.
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH net-next] net: allow SO_MARK with CAP_NET_RAW via cmsg
2022-01-31 23:33 [PATCH net-next] net: allow SO_MARK with CAP_NET_RAW via cmsg Jakub Kicinski
2022-02-01 1:02 ` Maciej Żenczykowski
@ 2022-02-01 3:30 ` David Ahern
2022-02-02 4:10 ` patchwork-bot+netdevbpf
2 siblings, 0 replies; 4+ messages in thread
From: David Ahern @ 2022-02-01 3:30 UTC (permalink / raw)
To: Jakub Kicinski, davem; +Cc: netdev, edumazet, maze
On 1/31/22 4:33 PM, Jakub Kicinski wrote:
> There's not reason SO_MARK would be allowed via setsockopt()
> and not via cmsg, let's keep the two consistent. See
> commit 079925cce1d0 ("net: allow SO_MARK with CAP_NET_RAW")
> for justification why NET_RAW -> SO_MARK is safe.
>
> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
> --
> CC: maze@google.com
> ---
> net/core/sock.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
Reviewed-by: David Ahern <dsahern@kernel.org>
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH net-next] net: allow SO_MARK with CAP_NET_RAW via cmsg
2022-01-31 23:33 [PATCH net-next] net: allow SO_MARK with CAP_NET_RAW via cmsg Jakub Kicinski
2022-02-01 1:02 ` Maciej Żenczykowski
2022-02-01 3:30 ` David Ahern
@ 2022-02-02 4:10 ` patchwork-bot+netdevbpf
2 siblings, 0 replies; 4+ messages in thread
From: patchwork-bot+netdevbpf @ 2022-02-02 4:10 UTC (permalink / raw)
To: Jakub Kicinski; +Cc: davem, netdev, dsahern, edumazet, maze
Hello:
This patch was applied to netdev/net-next.git (master)
by Jakub Kicinski <kuba@kernel.org>:
On Mon, 31 Jan 2022 15:33:57 -0800 you wrote:
> There's not reason SO_MARK would be allowed via setsockopt()
> and not via cmsg, let's keep the two consistent. See
> commit 079925cce1d0 ("net: allow SO_MARK with CAP_NET_RAW")
> for justification why NET_RAW -> SO_MARK is safe.
>
> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
> --
> CC: maze@google.com
>
> [...]
Here is the summary with links:
- [net-next] net: allow SO_MARK with CAP_NET_RAW via cmsg
https://git.kernel.org/netdev/net-next/c/91f0d8a4813a
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2022-02-02 4:10 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2022-01-31 23:33 [PATCH net-next] net: allow SO_MARK with CAP_NET_RAW via cmsg Jakub Kicinski
2022-02-01 1:02 ` Maciej Żenczykowski
2022-02-01 3:30 ` David Ahern
2022-02-02 4:10 ` patchwork-bot+netdevbpf
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).