* [PATCH v2 net 0/2] net: openvswitch: metering and conntrack in userns @ 2022-09-21 1:19 Michael Weiß 2022-09-21 1:19 ` [PATCH v2 net 1/2] net: openvswitch: allow metering in non-initial user namespace Michael Weiß 2022-09-21 1:19 ` [PATCH v2 net 2/2] net: openvswitch: allow conntrack " Michael Weiß 0 siblings, 2 replies; 4+ messages in thread From: Michael Weiß @ 2022-09-21 1:19 UTC (permalink / raw) To: Paolo Abeni, Pravin B Shelar, David S . Miller Cc: Michael Weiß, Eric Dumazet, Jakub Kicinski, netdev, dev, linux-kernel Currently using openvswitch in a non-initial user namespace, e.g., an unprivileged container, is possible but without metering and conntrack support. This is due to the restriction of the corresponding Netlink interfaces to the global CAP_NET_ADMIN. This simple patches switch from GENL_ADMIN_PERM to GENL_UNS_ADMIN_PERM in several cases to allow this also for the unprivileged container use case. We tested this for unprivileged containers created by the container manager of GyroidOS (gyroidos.github.io). However, for other container managers such as LXC or systemd which provide unprivileged containers this should be apply equally. Changes in v2: - changed GFP_KERNEL to GFP_KERNEL_ACCOUNT in dp_meter_create() as suggested by Paolo - Rebased on net branch of networking tree Michael Weiß (2): net: openvswitch: allow metering in non-initial user namespace net: openvswitch: allow conntrack in non-initial user namespace net/openvswitch/conntrack.c | 10 ++++++---- net/openvswitch/meter.c | 14 +++++++------- 2 files changed, 13 insertions(+), 11 deletions(-) -- 2.30.2 ^ permalink raw reply [flat|nested] 4+ messages in thread
* [PATCH v2 net 1/2] net: openvswitch: allow metering in non-initial user namespace 2022-09-21 1:19 [PATCH v2 net 0/2] net: openvswitch: metering and conntrack in userns Michael Weiß @ 2022-09-21 1:19 ` Michael Weiß 2022-09-21 1:19 ` [PATCH v2 net 2/2] net: openvswitch: allow conntrack " Michael Weiß 1 sibling, 0 replies; 4+ messages in thread From: Michael Weiß @ 2022-09-21 1:19 UTC (permalink / raw) To: Paolo Abeni, Pravin B Shelar, David S . Miller Cc: Michael Weiß, Eric Dumazet, Jakub Kicinski, netdev, dev, linux-kernel The Netlink interface for metering was restricted to global CAP_NET_ADMIN by using GENL_ADMIN_PERM. To allow metring in a non-inital user namespace, e.g., a container, this is changed to GENL_UNS_ADMIN_PERM. Signed-off-by: Michael Weiß <michael.weiss@aisec.fraunhofer.de> --- net/openvswitch/meter.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/net/openvswitch/meter.c b/net/openvswitch/meter.c index 04a060ac7fdf..7a56efd3406b 100644 --- a/net/openvswitch/meter.c +++ b/net/openvswitch/meter.c @@ -343,7 +343,7 @@ static struct dp_meter *dp_meter_create(struct nlattr **a) return ERR_PTR(-EINVAL); /* Allocate and set up the meter before locking anything. */ - meter = kzalloc(struct_size(meter, bands, n_bands), GFP_KERNEL); + meter = kzalloc(struct_size(meter, bands, n_bands), GFP_KERNEL_ACCOUNT); if (!meter) return ERR_PTR(-ENOMEM); @@ -687,9 +687,9 @@ static const struct genl_small_ops dp_meter_genl_ops[] = { }, { .cmd = OVS_METER_CMD_SET, .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, - .flags = GENL_ADMIN_PERM, /* Requires CAP_NET_ADMIN - * privilege. - */ + .flags = GENL_UNS_ADMIN_PERM, /* Requires CAP_NET_ADMIN + * privilege. + */ .doit = ovs_meter_cmd_set, }, { .cmd = OVS_METER_CMD_GET, @@ -699,9 +699,9 @@ static const struct genl_small_ops dp_meter_genl_ops[] = { }, { .cmd = OVS_METER_CMD_DEL, .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, - .flags = GENL_ADMIN_PERM, /* Requires CAP_NET_ADMIN - * privilege. - */ + .flags = GENL_UNS_ADMIN_PERM, /* Requires CAP_NET_ADMIN + * privilege. + */ .doit = ovs_meter_cmd_del }, }; -- 2.30.2 ^ permalink raw reply related [flat|nested] 4+ messages in thread
* [PATCH v2 net 2/2] net: openvswitch: allow conntrack in non-initial user namespace 2022-09-21 1:19 [PATCH v2 net 0/2] net: openvswitch: metering and conntrack in userns Michael Weiß 2022-09-21 1:19 ` [PATCH v2 net 1/2] net: openvswitch: allow metering in non-initial user namespace Michael Weiß @ 2022-09-21 1:19 ` Michael Weiß 2022-09-22 14:03 ` Jakub Kicinski 1 sibling, 1 reply; 4+ messages in thread From: Michael Weiß @ 2022-09-21 1:19 UTC (permalink / raw) To: Paolo Abeni, Pravin B Shelar, David S . Miller Cc: Michael Weiß, Eric Dumazet, Jakub Kicinski, netdev, dev, linux-kernel Similar to the previous commit, the Netlink interface of the OVS conntrack module was restricted to global CAP_NET_ADMIN by using GENL_ADMIN_PERM. This is changed to GENL_UNS_ADMIN_PERM to support unprivileged containers in non-initial user namespace. Signed-off-by: Michael Weiß <michael.weiss@aisec.fraunhofer.de> --- net/openvswitch/conntrack.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c index 4e70df91d0f2..9142ba322991 100644 --- a/net/openvswitch/conntrack.c +++ b/net/openvswitch/conntrack.c @@ -2252,14 +2252,16 @@ static int ovs_ct_limit_cmd_get(struct sk_buff *skb, struct genl_info *info) static const struct genl_small_ops ct_limit_genl_ops[] = { { .cmd = OVS_CT_LIMIT_CMD_SET, .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, - .flags = GENL_ADMIN_PERM, /* Requires CAP_NET_ADMIN - * privilege. */ + .flags = GENL_UNS_ADMIN_PERM, /* Requires CAP_NET_ADMIN + * privilege. + */ .doit = ovs_ct_limit_cmd_set, }, { .cmd = OVS_CT_LIMIT_CMD_DEL, .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, - .flags = GENL_ADMIN_PERM, /* Requires CAP_NET_ADMIN - * privilege. */ + .flags = GENL_UNS_ADMIN_PERM, /* Requires CAP_NET_ADMIN + * privilege. + */ .doit = ovs_ct_limit_cmd_del, }, { .cmd = OVS_CT_LIMIT_CMD_GET, -- 2.30.2 ^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH v2 net 2/2] net: openvswitch: allow conntrack in non-initial user namespace 2022-09-21 1:19 ` [PATCH v2 net 2/2] net: openvswitch: allow conntrack " Michael Weiß @ 2022-09-22 14:03 ` Jakub Kicinski 0 siblings, 0 replies; 4+ messages in thread From: Jakub Kicinski @ 2022-09-22 14:03 UTC (permalink / raw) To: Michael Weiß Cc: Paolo Abeni, Pravin B Shelar, David S . Miller, Eric Dumazet, netdev, dev, linux-kernel, Joe Stringer On Wed, 21 Sep 2022 03:19:46 +0200 Michael Weiß wrote: > Similar to the previous commit, the Netlink interface of the OVS > conntrack module was restricted to global CAP_NET_ADMIN by using > GENL_ADMIN_PERM. This is changed to GENL_UNS_ADMIN_PERM to support > unprivileged containers in non-initial user namespace. Should we bump ct_limit = kmalloc(sizeof(*ct_limit), GFP_KERNEL); to also being accounted? Otherwise LGTM, please repost with [PATCH net-next v3] in the subject. net is for fixes only, and we're quite late in the -rc process. Please try to CC the original authors as well, for Joe the address will be Joe Stringer <joe@cilium.io>. > diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c > index 4e70df91d0f2..9142ba322991 100644 > --- a/net/openvswitch/conntrack.c > +++ b/net/openvswitch/conntrack.c > @@ -2252,14 +2252,16 @@ static int ovs_ct_limit_cmd_get(struct sk_buff *skb, struct genl_info *info) > static const struct genl_small_ops ct_limit_genl_ops[] = { > { .cmd = OVS_CT_LIMIT_CMD_SET, > .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, > - .flags = GENL_ADMIN_PERM, /* Requires CAP_NET_ADMIN > - * privilege. */ > + .flags = GENL_UNS_ADMIN_PERM, /* Requires CAP_NET_ADMIN > + * privilege. > + */ > .doit = ovs_ct_limit_cmd_set, > }, > { .cmd = OVS_CT_LIMIT_CMD_DEL, > .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, > - .flags = GENL_ADMIN_PERM, /* Requires CAP_NET_ADMIN > - * privilege. */ > + .flags = GENL_UNS_ADMIN_PERM, /* Requires CAP_NET_ADMIN > + * privilege. > + */ > .doit = ovs_ct_limit_cmd_del, > }, > { .cmd = OVS_CT_LIMIT_CMD_GET, ^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2022-09-22 14:03 UTC | newest] Thread overview: 4+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2022-09-21 1:19 [PATCH v2 net 0/2] net: openvswitch: metering and conntrack in userns Michael Weiß 2022-09-21 1:19 ` [PATCH v2 net 1/2] net: openvswitch: allow metering in non-initial user namespace Michael Weiß 2022-09-21 1:19 ` [PATCH v2 net 2/2] net: openvswitch: allow conntrack " Michael Weiß 2022-09-22 14:03 ` Jakub Kicinski
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).