* [PATCH] l2tp: Allow management of tunnels and session in user namespace
@ 2020-04-07 11:11 Michael Weiß
2020-04-08 21:31 ` David Miller
0 siblings, 1 reply; 2+ messages in thread
From: Michael Weiß @ 2020-04-07 11:11 UTC (permalink / raw)
To: David S . Miller, Jakub Kicinski; +Cc: netdev, Michael Weiß
Creation and management of L2TPv3 tunnels and session through netlink
requires CAP_NET_ADMIN. However, a process with CAP_NET_ADMIN in a
non-initial user namespace gets an EPERM due to the use of the
genetlink GENL_ADMIN_PERM flag. Thus, management of L2TP VPNs inside
an unprivileged container won't work.
We replaced the GENL_ADMIN_PERM by the GENL_UNS_ADMIN_PERM flag
similar to other network modules which also had this problem, e.g.,
openvswitch (commit 4a92602aa1cd "openvswitch: allow management from
inside user namespaces") and nl80211 (commit 5617c6cd6f844 "nl80211:
Allow privileged operations from user namespaces").
I tested this in the container runtime trustm3 (trustm3.github.io)
and was able to create l2tp tunnels and sessions in unpriviliged
(user namespaced) containers using a private network namespace.
For other runtimes such as docker or lxc this should work, too.
Signed-off-by: Michael Weiß <michael.weiss@aisec.fraunhofer.de>
---
net/l2tp/l2tp_netlink.c | 16 ++++++++--------
1 file changed, 8 insertions(+), 8 deletions(-)
diff --git a/net/l2tp/l2tp_netlink.c b/net/l2tp/l2tp_netlink.c
index f5a9bdc4980c..ebb381c3f1b9 100644
--- a/net/l2tp/l2tp_netlink.c
+++ b/net/l2tp/l2tp_netlink.c
@@ -920,51 +920,51 @@ static const struct genl_ops l2tp_nl_ops[] = {
.cmd = L2TP_CMD_TUNNEL_CREATE,
.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
.doit = l2tp_nl_cmd_tunnel_create,
- .flags = GENL_ADMIN_PERM,
+ .flags = GENL_UNS_ADMIN_PERM,
},
{
.cmd = L2TP_CMD_TUNNEL_DELETE,
.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
.doit = l2tp_nl_cmd_tunnel_delete,
- .flags = GENL_ADMIN_PERM,
+ .flags = GENL_UNS_ADMIN_PERM,
},
{
.cmd = L2TP_CMD_TUNNEL_MODIFY,
.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
.doit = l2tp_nl_cmd_tunnel_modify,
- .flags = GENL_ADMIN_PERM,
+ .flags = GENL_UNS_ADMIN_PERM,
},
{
.cmd = L2TP_CMD_TUNNEL_GET,
.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
.doit = l2tp_nl_cmd_tunnel_get,
.dumpit = l2tp_nl_cmd_tunnel_dump,
- .flags = GENL_ADMIN_PERM,
+ .flags = GENL_UNS_ADMIN_PERM,
},
{
.cmd = L2TP_CMD_SESSION_CREATE,
.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
.doit = l2tp_nl_cmd_session_create,
- .flags = GENL_ADMIN_PERM,
+ .flags = GENL_UNS_ADMIN_PERM,
},
{
.cmd = L2TP_CMD_SESSION_DELETE,
.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
.doit = l2tp_nl_cmd_session_delete,
- .flags = GENL_ADMIN_PERM,
+ .flags = GENL_UNS_ADMIN_PERM,
},
{
.cmd = L2TP_CMD_SESSION_MODIFY,
.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
.doit = l2tp_nl_cmd_session_modify,
- .flags = GENL_ADMIN_PERM,
+ .flags = GENL_UNS_ADMIN_PERM,
},
{
.cmd = L2TP_CMD_SESSION_GET,
.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
.doit = l2tp_nl_cmd_session_get,
.dumpit = l2tp_nl_cmd_session_dump,
- .flags = GENL_ADMIN_PERM,
+ .flags = GENL_UNS_ADMIN_PERM,
},
};
--
2.20.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] l2tp: Allow management of tunnels and session in user namespace
2020-04-07 11:11 [PATCH] l2tp: Allow management of tunnels and session in user namespace Michael Weiß
@ 2020-04-08 21:31 ` David Miller
0 siblings, 0 replies; 2+ messages in thread
From: David Miller @ 2020-04-08 21:31 UTC (permalink / raw)
To: michael.weiss; +Cc: kuba, netdev
From: Michael Weiß <michael.weiss@aisec.fraunhofer.de>
Date: Tue, 7 Apr 2020 13:11:48 +0200
> Creation and management of L2TPv3 tunnels and session through netlink
> requires CAP_NET_ADMIN. However, a process with CAP_NET_ADMIN in a
> non-initial user namespace gets an EPERM due to the use of the
> genetlink GENL_ADMIN_PERM flag. Thus, management of L2TP VPNs inside
> an unprivileged container won't work.
>
> We replaced the GENL_ADMIN_PERM by the GENL_UNS_ADMIN_PERM flag
> similar to other network modules which also had this problem, e.g.,
> openvswitch (commit 4a92602aa1cd "openvswitch: allow management from
> inside user namespaces") and nl80211 (commit 5617c6cd6f844 "nl80211:
> Allow privileged operations from user namespaces").
>
> I tested this in the container runtime trustm3 (trustm3.github.io)
> and was able to create l2tp tunnels and sessions in unpriviliged
> (user namespaced) containers using a private network namespace.
> For other runtimes such as docker or lxc this should work, too.
>
> Signed-off-by: Michael Weiß <michael.weiss@aisec.fraunhofer.de>
Applied, thank you.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2020-04-08 21:31 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-04-07 11:11 [PATCH] l2tp: Allow management of tunnels and session in user namespace Michael Weiß
2020-04-08 21:31 ` David Miller
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.