genetlink: Use internal flags for multicast groups

As explained in commit e03781879a0d ("drop_monitor: Require
'CAP_SYS_ADMIN' when joining "events" group"), the "flags" field in the
multicast group structure reuses uAPI flags despite the field not being
exposed to user space. This makes it impossible to extend its use
without adding new uAPI flags, which is inappropriate for internal
kernel checks.

Solve this by adding internal flags (i.e., "GENL_MCAST_*") and convert
the existing users to use them instead of the uAPI flags.

Tested using the reproducers in commit 44ec98ea5ea9 ("psample: Require
'CAP_NET_ADMIN' when joining "packets" group") and commit e03781879a0d
("drop_monitor: Require 'CAP_SYS_ADMIN' when joining "events" group").

No functional changes intended.

Signed-off-by: Ido Schimmel <idosch@nvidia.com>
Reviewed-by: Mat Martineau <martineau@kernel.org>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/include/net/genetlink.h b/include/net/genetlink.h
index 85c63d4f16dd1ba20e0dc690500dd8fdb84846dd..e61469129402be57d5a6cc6ed9f9ac81e40e47a6 100644 (file)
--- a/include/net/genetlink.h
+++ b/include/net/genetlink.h
@@ -8,16 +8,19 @@
 
 #define GENLMSG_DEFAULT_SIZE (NLMSG_DEFAULT_SIZE - GENL_HDRLEN)
 
+/* Binding to multicast group requires %CAP_NET_ADMIN */
+#define GENL_MCAST_CAP_NET_ADMIN       BIT(0)
+/* Binding to multicast group requires %CAP_SYS_ADMIN */
+#define GENL_MCAST_CAP_SYS_ADMIN       BIT(1)
+
 /**
  * struct genl_multicast_group - generic netlink multicast group
  * @name: name of the multicast group, names are per-family
- * @flags: GENL_* flags (%GENL_ADMIN_PERM or %GENL_UNS_ADMIN_PERM)
- * @cap_sys_admin: whether %CAP_SYS_ADMIN is required for binding
+ * @flags: GENL_MCAST_* flags
  */
 struct genl_multicast_group {
        char                    name[GENL_NAMSIZ];
        u8                      flags;
-       u8                      cap_sys_admin:1;
 };
 
 struct genl_split_ops;

diff --git a/net/core/drop_monitor.c b/net/core/drop_monitor.c
index b240d9aae4a6435cdd973f27e54b48f7bd8f9298..b0f221d658be818538851f1c6c72785537437ae1 100644 (file)
--- a/net/core/drop_monitor.c
+++ b/net/core/drop_monitor.c
@@ -183,7 +183,7 @@ static struct sk_buff *reset_per_cpu_data(struct per_cpu_dm_data *data)
 }
 
 static const struct genl_multicast_group dropmon_mcgrps[] = {
-       { .name = "events", .cap_sys_admin = 1 },
+       { .name = "events", .flags = GENL_MCAST_CAP_SYS_ADMIN, },
 };
 
 static void send_dm_alert(struct work_struct *work)

diff --git a/net/mptcp/pm_netlink.c b/net/mptcp/pm_netlink.c
index bf4d96f6f99a6e87d1b30c84a316d12c925bbcb2..272e93be1aad083646285dde001f9f05a686fca9 100644 (file)
--- a/net/mptcp/pm_netlink.c
+++ b/net/mptcp/pm_netlink.c
@@ -1100,7 +1100,7 @@ int mptcp_pm_nl_get_local_id(struct mptcp_sock *msk, struct mptcp_addr_info *skc
 static const struct genl_multicast_group mptcp_pm_mcgrps[] = {
        [MPTCP_PM_CMD_GRP_OFFSET]       = { .name = MPTCP_PM_CMD_GRP_NAME, },
        [MPTCP_PM_EV_GRP_OFFSET]        = { .name = MPTCP_PM_EV_GRP_NAME,
-                                           .flags = GENL_UNS_ADMIN_PERM,
+                                           .flags = GENL_MCAST_CAP_NET_ADMIN,
                                          },
 };
 

diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c
index c0d15470a10b342578fcd82d25c19b0f1be03122..8c7af02f845400473becca42527ee0fbd7a29883 100644 (file)
--- a/net/netlink/genetlink.c
+++ b/net/netlink/genetlink.c
@@ -1829,10 +1829,10 @@ static int genl_bind(struct net *net, int group)
                        continue;
 
                grp = &family->mcgrps[i];
-               if ((grp->flags & GENL_UNS_ADMIN_PERM) &&
+               if ((grp->flags & GENL_MCAST_CAP_NET_ADMIN) &&
                    !ns_capable(net->user_ns, CAP_NET_ADMIN))
                        ret = -EPERM;
-               if (grp->cap_sys_admin &&
+               if ((grp->flags & GENL_MCAST_CAP_SYS_ADMIN) &&
                    !ns_capable(net->user_ns, CAP_SYS_ADMIN))
                        ret = -EPERM;
 

diff --git a/net/psample/psample.c b/net/psample/psample.c
index c34e902855dbefdd37b86e2f9cb9ef067be87c3d..ddd211a151d0d9a8153cb4f7bf155b3272be68b4 100644 (file)
--- a/net/psample/psample.c
+++ b/net/psample/psample.c
@@ -32,7 +32,7 @@ enum psample_nl_multicast_groups {
 static const struct genl_multicast_group psample_nl_mcgrps[] = {
        [PSAMPLE_NL_MCGRP_CONFIG] = { .name = PSAMPLE_NL_MCGRP_CONFIG_NAME },
        [PSAMPLE_NL_MCGRP_SAMPLE] = { .name = PSAMPLE_NL_MCGRP_SAMPLE_NAME,
-                                     .flags = GENL_UNS_ADMIN_PERM },
+                                     .flags = GENL_MCAST_CAP_NET_ADMIN, },
 };
 
 static struct genl_family psample_nl_family __ro_after_init;