From patchwork Sun Sep 11 17:38:24 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Michael_Wei=C3=9F?= X-Patchwork-Id: 12972991 X-Patchwork-Delegate: kuba@kernel.org Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5FE3AECAAD3 for ; Sun, 11 Sep 2022 17:39:26 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229566AbiIKRjX (ORCPT ); Sun, 11 Sep 2022 13:39:23 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54960 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229446AbiIKRjV (ORCPT ); Sun, 11 Sep 2022 13:39:21 -0400 Received: from mout.kundenserver.de (mout.kundenserver.de [212.227.126.131]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6E5681CB2F; Sun, 11 Sep 2022 10:39:17 -0700 (PDT) Received: from weisslap.fritz.box ([31.19.218.61]) by mrelayeu.kundenserver.de (mreue012 [212.227.15.167]) with ESMTPSA (Nemesis) id 1N2BQM-1pTPU80Oy6-013hgl; Sun, 11 Sep 2022 19:39:02 +0200 From: =?utf-8?q?Michael_Wei=C3=9F?= To: michael.weiss@aisec.fraunhofer.de Cc: Pravin B Shelar , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , netdev@vger.kernel.org, dev@openvswitch.org, linux-kernel@vger.kernel.org Subject: [PATCH 1/2] net: openvswitch: allow metering in non-initial user namespace Date: Sun, 11 Sep 2022 19:38:24 +0200 Message-Id: <20220911173825.167352-2-michael.weiss@aisec.fraunhofer.de> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20220911173825.167352-1-michael.weiss@aisec.fraunhofer.de> References: <20220911173825.167352-1-michael.weiss@aisec.fraunhofer.de> MIME-Version: 1.0 X-Provags-ID: V03:K1:w/ZIwJ+8nh0FNsS3l1YJRPVdBgx4sNNx74rYQEKqYK507/lgsNC DfiX5KqbUfq8xLewqauUZsW4nemeKXm5KG7jylWLaeKUkeQgowinbVHu9mu0ro88CNBiQ49 V/ECAt946K7QBKOHnsmohJiHkPffV3Mqo+M1JYrXoDoRrTZ0ui3xvV1wnt3Gwnl6bZ74BxO r+AW26zOooCjM9D+dG8hA== X-UI-Out-Filterresults: notjunk:1;V03:K0:hMwyr5DwtJM=:DJCNPb7Ejd+YkGeiqxlq4H i3O+AlMvg1N+Eh8oIR/57zCeU8p54zW2HNiH0hXirbYPpa44LaSFJms478RigobsVw/1itxhu H/m4FWFXk/YLlaCELPvf4Y9sHuow4S0RMTgN0XoqlPxcJcMazKVJqQWlZ7I0gMkX8Kj9pSUX8 SoiOMRdZqiQCdKoCM/+isG9eQcDExz54kik4iMFt5GoehGgbz75n8b5rjbdKDDWu5GXLwRn26 JE3vvJ8R3jePk1zUYez8hb0qc0sBpTua5/WEeCNzocYdvaeLBYvG8G1cCEUoqa4ArEHnOr7a+ SkrCvQgz/dkUPE4+2zfWqM14a0qvc239HU6VOxQp1b6gzY4QsS8ogVLIbrUuNWCy68AaZTtFD tJzU2886CR6t4uOfy/Q5xs4blQ8LJq9YAH5xWBNWlUNnRcLRvTIRjG5Ykzdc/D4bfMjGf4d23 ebdlythCPaEZa4/2L0qy0wBdxKDQTBLIDuGqdpLnejXqRcduI6TVx8tGgMmLCVgm8IA249yLo yxoCcJKg40sgjDr4LBeM29iVrn8TUwFwLJXq/b3sPorAxY5T9L7AlKhNZt+tZAy9oLKMqQU+C 0sLEv2hUGsd19o7NC4SMQGzokKXcdaiy2hauPYJNYCjPXLgDT3EJgLvCPCYP9gWHYdx+eihxW P0WAECMtRDXFstpSrQSjztZdfPWMRBagfXLhSv+0y/dOkf4OMnHgbbHGinfUr/EQBpK/EkTN9 pV3hgveQdJyDGCV2ZF4xXzEhkfEP+4WsqYff2t0itW6PxXt2VJLBviyzSkppGwadi1WN1JVNW TXJdYSYqT4GX4ihbQ0C2RLUAP4Eug== Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org X-Patchwork-Delegate: kuba@kernel.org The Netlink interface for metering was restricted to global CAP_NET_ADMIN by using GENL_ADMIN_PERM. To allow metring in a non-inital user namespace, e.g., a container, this is changed to GENL_UNS_ADMIN_PERM. Signed-off-by: Michael Weiß --- net/openvswitch/meter.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/net/openvswitch/meter.c b/net/openvswitch/meter.c index 04a060ac7fdf..e9ef050a0dd5 100644 --- a/net/openvswitch/meter.c +++ b/net/openvswitch/meter.c @@ -687,9 +687,9 @@ static const struct genl_small_ops dp_meter_genl_ops[] = { }, { .cmd = OVS_METER_CMD_SET, .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, - .flags = GENL_ADMIN_PERM, /* Requires CAP_NET_ADMIN - * privilege. - */ + .flags = GENL_UNS_ADMIN_PERM, /* Requires CAP_NET_ADMIN + * privilege. + */ .doit = ovs_meter_cmd_set, }, { .cmd = OVS_METER_CMD_GET, @@ -699,9 +699,9 @@ static const struct genl_small_ops dp_meter_genl_ops[] = { }, { .cmd = OVS_METER_CMD_DEL, .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, - .flags = GENL_ADMIN_PERM, /* Requires CAP_NET_ADMIN - * privilege. - */ + .flags = GENL_UNS_ADMIN_PERM, /* Requires CAP_NET_ADMIN + * privilege. + */ .doit = ovs_meter_cmd_del }, }; From patchwork Sun Sep 11 17:38:25 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Michael_Wei=C3=9F?= X-Patchwork-Id: 12972992 X-Patchwork-Delegate: kuba@kernel.org Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D8BACC6FA8B for ; Sun, 11 Sep 2022 17:39:27 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229577AbiIKRjY (ORCPT ); Sun, 11 Sep 2022 13:39:24 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54966 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229540AbiIKRjW (ORCPT ); Sun, 11 Sep 2022 13:39:22 -0400 Received: from mout.kundenserver.de (mout.kundenserver.de [212.227.126.135]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 329002A424; Sun, 11 Sep 2022 10:39:17 -0700 (PDT) Received: from weisslap.fritz.box ([31.19.218.61]) by mrelayeu.kundenserver.de (mreue012 [212.227.15.167]) with ESMTPSA (Nemesis) id 1M5jA2-1oQGBJ1wgE-0079XX; Sun, 11 Sep 2022 19:39:03 +0200 From: =?utf-8?q?Michael_Wei=C3=9F?= To: michael.weiss@aisec.fraunhofer.de Cc: Pravin B Shelar , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , netdev@vger.kernel.org, dev@openvswitch.org, linux-kernel@vger.kernel.org Subject: [PATCH 2/2] net: openvswitch: allow conntrack in non-initial user namespace Date: Sun, 11 Sep 2022 19:38:25 +0200 Message-Id: <20220911173825.167352-3-michael.weiss@aisec.fraunhofer.de> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20220911173825.167352-1-michael.weiss@aisec.fraunhofer.de> References: <20220911173825.167352-1-michael.weiss@aisec.fraunhofer.de> MIME-Version: 1.0 X-Provags-ID: V03:K1:gpLQ3c73SdDEYMlyQGcD2ju4281fFu829DmezQnPTBEZ4ckL7Dy o/GWcNeoeESSuI5LLfnTzuI9G3v79KI4adgJUA9SNSpFDHybQLkkkLOwaf2cuAUi1prG6s7 4KL7kXfmeoCGhyWTo7rPh0nOzg3TcCYj0OHWLHRVpCWrhQVLMZTOJRG+mBKs+qfWsJPLpQZ HaIv1wnUpoeueBYl/9OGQ== X-UI-Out-Filterresults: notjunk:1;V03:K0:OL3ZAcrJl6A=:dAi/XX0PtUHUqZaCfv7ZUJ 4mgU7+DVleH4/NiRiBQ6pBXZQNTN8uTDTEcW0zqs3J+tJ3ILZf7GXtJwUbAM4i4aBGMtzk7vB aAKl7Ns7Qxq1e4lQupZ/IHbKR2VXHsaL7PiJ5E/PSbub/eSLCO5Qgpqs9iZ5DfpiIWrFdLZP5 A7tnftiiL6t+8lEqy0cOQxxOPRa63V9BQlMVGVSTTuQ/GcQmRruwVxbd+s9N7lgljwqi5yltJ PQGCgs5Z6chGQXA76eRnbosS/WxrHHWlHEFEV8kJwKuntXLchSrGzgnJ9OxhIMGVupHQmlrJP xn4YirTwu973xrhxdrAZj1PPZfxRQtAOEh+/KUHaWs2q6KQnAzTxrnB/5l8zgLMnq/G6o/z6+ NSmEpgnVUUZjFFQnyt8+TEAknLkv42+zRyisnzDqUC4t/Tmqmh5+dH1lTSPhroxq8NWjzskrU Ca4Vh5bDayDP7pxxqtaeoFmxe7lgUouQ0/7urupIjYLdKWREIDK4eBQlELz4o5EpodHaEvdIz mFHgc45eePlq1KGpPSr1+m/UnSjd4tistKJzOfXtoPcl8ttFNBTgOwWosctITsjYXwfex1Lb2 zMECuLqKdHFhHwZsrR09ef6eD4cUmBEspSv06X9/UmCfBQ0cT+OG2URHstY7YtwZekAaX9jNc tsKJvH708i2n10MDAuyrH9j0CWgbJqVkGUAnB6jGuh3OwUXMakMsV51XrUj1Em4nNqEwfcx6l PzopeQu6I6vs071JnfPV4yFRMRXyLBe75W9mO6j5vr5n0wcsSDxOBL0wD6G8y5eJS4nVdTY2z 2lYFYhRHPabDWEZ1bTC0Ab/5axFfw== Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org X-Patchwork-Delegate: kuba@kernel.org Similar to the previous commit, the Netlink interface of the OVS conntrack module was restricted to global CAP_NET_ADMIN by using GENL_ADMIN_PERM. This is changed to GENL_UNS_ADMIN_PERM to support unprivileged containers in non-initial user namespace. Signed-off-by: Michael Weiß --- net/openvswitch/conntrack.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c index 4e70df91d0f2..23f5b6261364 100644 --- a/net/openvswitch/conntrack.c +++ b/net/openvswitch/conntrack.c @@ -2252,14 +2252,14 @@ static int ovs_ct_limit_cmd_get(struct sk_buff *skb, struct genl_info *info) static const struct genl_small_ops ct_limit_genl_ops[] = { { .cmd = OVS_CT_LIMIT_CMD_SET, .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, - .flags = GENL_ADMIN_PERM, /* Requires CAP_NET_ADMIN - * privilege. */ + .flags = GENL_UNS_ADMIN_PERM, /* Requires CAP_NET_ADMIN + * privilege. */ .doit = ovs_ct_limit_cmd_set, }, { .cmd = OVS_CT_LIMIT_CMD_DEL, .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, - .flags = GENL_ADMIN_PERM, /* Requires CAP_NET_ADMIN - * privilege. */ + .flags = GENL_UNS_ADMIN_PERM, /* Requires CAP_NET_ADMIN + * privilege. */ .doit = ovs_ct_limit_cmd_del, }, { .cmd = OVS_CT_LIMIT_CMD_GET,