From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B4847379EE6 for ; Fri, 29 May 2026 17:06:12 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780074374; cv=none; b=Ra4V/f+82gkJ7aIzF2QjwyMZFSpbdB8c4qqPOWPzad7fGDFX11kJnCbVtfGXTdBAZIuad5xI8/ZKoZkC7Aq137uZYepgBYrUR1H28VBGpFciAga4c+jA7Nnxft0SU2ZboCQYNBVkUrlGGmLNeKeFqxu5mX2mW7Lv8CAMTZlGzRY= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780074374; c=relaxed/simple; bh=rKE9dn4vHgg0nNO2QesMHGv3NJiE8OuTbAi6gTzW0z0=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=dBMDHXUeVgWbWPNnNP7hU10upGpBoW3Ni6RyCy3SXSq0yBAolrp0eZwV+DswFBfpiK3/OosRubWC4P3wdjLgpoJK0RnHcqSV+2zCKR+JBFnnZZ+1TfG0NYdAjZLxEIUcujJHvQlzLp1wknuGxBnMQoO28dUA9Yfq3BX7ZH/Zln4= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=RJMHeiJj; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="RJMHeiJj" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8D23E1F00893; Fri, 29 May 2026 17:06:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1780074372; bh=gszwxumVNIPAj9EK3b1WwC7R1PFLNGvFo1tQaw20jus=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=RJMHeiJjSGNhYnl4+FsgtIEHBbIXpS6gnriHOxu0DAXTJ8ybvoeY/VToYmS4t+1eo JlTN+mouA04eiOZh370X9ZUVmOqw9jsgdFp5cbWgpQ6R2YcQoL3lUuxIuMnunQHVS4 Xlr64mKfRfYwm+P/PrjnEwCpevSGJVo5R+cLU4vGkYEpU1jc6WH4rm0eARNgOnI+lC 2sPzswFZe+Nc7/sOdpdSqpQkuRcv/LALXZ/qWA/EzKEX/9Hl5Jk0pA73hW98AclavC CQx7tjFs37i+5bB0N6MrzYqyzAGcoEvoE9RiJxJyLkM590MvhITOWlXtcz8aAYqHme QCZPmeIizvM5w== From: Sasha Levin To: stable@vger.kernel.org Cc: Ido Schimmel , Mat Martineau , Andy Shevchenko , "David S. Miller" , Sasha Levin Subject: [PATCH 6.1.y 1/2] genetlink: Use internal flags for multicast groups Date: Fri, 29 May 2026 13:06:09 -0400 Message-ID: <20260529170610.1279657-1-sashal@kernel.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <2026052830-undefined-astronomy-bd6a@gregkh> References: <2026052830-undefined-astronomy-bd6a@gregkh> Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: Ido Schimmel [ Upstream commit cd4d7263d58ab98fd4dee876776e4da6c328faa3 ] As explained in commit e03781879a0d ("drop_monitor: Require 'CAP_SYS_ADMIN' when joining "events" group"), the "flags" field in the multicast group structure reuses uAPI flags despite the field not being exposed to user space. This makes it impossible to extend its use without adding new uAPI flags, which is inappropriate for internal kernel checks. Solve this by adding internal flags (i.e., "GENL_MCAST_*") and convert the existing users to use them instead of the uAPI flags. Tested using the reproducers in commit 44ec98ea5ea9 ("psample: Require 'CAP_NET_ADMIN' when joining "packets" group") and commit e03781879a0d ("drop_monitor: Require 'CAP_SYS_ADMIN' when joining "events" group"). No functional changes intended. Signed-off-by: Ido Schimmel Reviewed-by: Mat Martineau Reviewed-by: Andy Shevchenko Signed-off-by: David S. Miller Stable-dep-of: d1ebfce2c1d1 ("smb: client: require net admin for CIFS SWN netlink") Signed-off-by: Sasha Levin --- include/net/genetlink.h | 9 ++++++--- net/core/drop_monitor.c | 2 +- net/mptcp/pm_netlink.c | 2 +- net/netlink/genetlink.c | 4 ++-- net/psample/psample.c | 2 +- 5 files changed, 11 insertions(+), 8 deletions(-) diff --git a/include/net/genetlink.h b/include/net/genetlink.h index b39d06bbb8390..e302515296813 100644 --- a/include/net/genetlink.h +++ b/include/net/genetlink.h @@ -8,16 +8,19 @@ #define GENLMSG_DEFAULT_SIZE (NLMSG_DEFAULT_SIZE - GENL_HDRLEN) +/* Binding to multicast group requires %CAP_NET_ADMIN */ +#define GENL_MCAST_CAP_NET_ADMIN BIT(0) +/* Binding to multicast group requires %CAP_SYS_ADMIN */ +#define GENL_MCAST_CAP_SYS_ADMIN BIT(1) + /** * struct genl_multicast_group - generic netlink multicast group * @name: name of the multicast group, names are per-family - * @flags: GENL_* flags (%GENL_ADMIN_PERM or %GENL_UNS_ADMIN_PERM) - * @cap_sys_admin: whether %CAP_SYS_ADMIN is required for binding + * @flags: GENL_MCAST_* flags */ struct genl_multicast_group { char name[GENL_NAMSIZ]; u8 flags; - u8 cap_sys_admin:1; }; struct genl_ops; diff --git a/net/core/drop_monitor.c b/net/core/drop_monitor.c index fef94f3b03de0..768a79428dc92 100644 --- a/net/core/drop_monitor.c +++ b/net/core/drop_monitor.c @@ -181,7 +181,7 @@ static struct sk_buff *reset_per_cpu_data(struct per_cpu_dm_data *data) } static const struct genl_multicast_group dropmon_mcgrps[] = { - { .name = "events", .cap_sys_admin = 1 }, + { .name = "events", .flags = GENL_MCAST_CAP_SYS_ADMIN, }, }; static void send_dm_alert(struct work_struct *work) diff --git a/net/mptcp/pm_netlink.c b/net/mptcp/pm_netlink.c index a16a7a538c425..4169c86ab0df5 100644 --- a/net/mptcp/pm_netlink.c +++ b/net/mptcp/pm_netlink.c @@ -1302,7 +1302,7 @@ bool mptcp_pm_nl_is_backup(struct mptcp_sock *msk, struct mptcp_addr_info *skc) static const struct genl_multicast_group mptcp_pm_mcgrps[] = { [MPTCP_PM_CMD_GRP_OFFSET] = { .name = MPTCP_PM_CMD_GRP_NAME, }, [MPTCP_PM_EV_GRP_OFFSET] = { .name = MPTCP_PM_EV_GRP_NAME, - .flags = GENL_UNS_ADMIN_PERM, + .flags = GENL_MCAST_CAP_NET_ADMIN, }, }; diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c index fd3c1f1ca6ea6..3a3b29ff63b31 100644 --- a/net/netlink/genetlink.c +++ b/net/netlink/genetlink.c @@ -1431,10 +1431,10 @@ static int genl_bind(struct net *net, int group) continue; grp = &family->mcgrps[i]; - if ((grp->flags & GENL_UNS_ADMIN_PERM) && + if ((grp->flags & GENL_MCAST_CAP_NET_ADMIN) && !ns_capable(net->user_ns, CAP_NET_ADMIN)) ret = -EPERM; - if (grp->cap_sys_admin && + if ((grp->flags & GENL_MCAST_CAP_SYS_ADMIN) && !ns_capable(net->user_ns, CAP_SYS_ADMIN)) ret = -EPERM; diff --git a/net/psample/psample.c b/net/psample/psample.c index c34e902855dbe..ddd211a151d0d 100644 --- a/net/psample/psample.c +++ b/net/psample/psample.c @@ -32,7 +32,7 @@ enum psample_nl_multicast_groups { static const struct genl_multicast_group psample_nl_mcgrps[] = { [PSAMPLE_NL_MCGRP_CONFIG] = { .name = PSAMPLE_NL_MCGRP_CONFIG_NAME }, [PSAMPLE_NL_MCGRP_SAMPLE] = { .name = PSAMPLE_NL_MCGRP_SAMPLE_NAME, - .flags = GENL_UNS_ADMIN_PERM }, + .flags = GENL_MCAST_CAP_NET_ADMIN, }, }; static struct genl_family psample_nl_family __ro_after_init; -- 2.53.0