From nobody Fri Apr 26 02:44:57 2024 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0F317C6FA8B for ; Fri, 23 Sep 2022 13:39:32 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232014AbiIWNj3 (ORCPT ); Fri, 23 Sep 2022 09:39:29 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51090 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229511AbiIWNj0 (ORCPT ); Fri, 23 Sep 2022 09:39:26 -0400 Received: from mout.kundenserver.de (mout.kundenserver.de [212.227.17.24]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id EDDE6139BFE; Fri, 23 Sep 2022 06:39:21 -0700 (PDT) Received: from weisslap.fritz.box ([31.19.218.61]) by mrelayeu.kundenserver.de (mreue107 [212.227.15.183]) with ESMTPSA (Nemesis) id 1MxmJs-1pU5KV2WtS-00zJGg; Fri, 23 Sep 2022 15:39:01 +0200 From: =?UTF-8?q?Michael=20Wei=C3=9F?= To: Paolo Abeni , Pravin B Shelar , "David S . Miller" , Jakub Kicinski Cc: Joe Stringer , Andy Zhou , =?UTF-8?q?Michael=20Wei=C3=9F?= , Eric Dumazet , netdev@vger.kernel.org, dev@openvswitch.org, linux-kernel@vger.kernel.org Subject: [PATCH v3 net-next 1/2] net: openvswitch: allow metering in non-initial user namespace Date: Fri, 23 Sep 2022 15:38:19 +0200 Message-Id: <20220923133820.993725-2-michael.weiss@aisec.fraunhofer.de> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20220923133820.993725-1-michael.weiss@aisec.fraunhofer.de> References: <20220923133820.993725-1-michael.weiss@aisec.fraunhofer.de> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Provags-ID: V03:K1:8BJhdeANIbyU9Gyu9QqbOBrCdMkiP8dsWL+xJhpcwLoeQRcOGhd D9NXxrNUUG4yYRqLdTnPi5/StOsE7PbxkHQ2NQ3ZDgGm+l9soYZIW0OhQnt4D6Zoqro1H5G 1fVwaU6qAzrMmH6crtn3bxgZWZ9ILiX56NSxPRQTv8On9X9UL09o+3U6IbQNb3QuYimhsTJ ZRq1UhutwVFfu6eTc0MaA== X-UI-Out-Filterresults: notjunk:1;V03:K0:z0HvyUFCiHY=:C5pE8R7+bGXr8IfUQN/kQ+ GSqPi5vKXAnh8kQCzApJQF+T2PGI7HdnzyL9RJJyvzlZrl7xi9KeaYnjt6yTKLemA4gc5U/mw tT/P9es9ffLfCyK4P9XPtDHRPalA+Fb+ayrfFzIWM7kSWBzOFmI/iBONEPaj+0Hj06M1CSvFD crZO+5zGCBR2pQFN/NI7GGzQUquUasLa5N1d9ScLYvSqnfIFbgPObEUqdDI8LVIrbom9tLMa0 To2ruDWyDWeMRfaIjLVU7pUNEoVww/F9Jym84PE8yNE/UkBtT7zJAhxe8fNutzOnXZwhgDL3v A56m+VRfBi4qVax3sG3eFNwKj/sbjRy69jc8uy5Q85tazOLF9DHZued368QMCDafSPNkNuoJU FBAVQzr2FSKu+ZWoQRwi5WzEqZ1+mea7zc5CaNGPly3+Ee8mHFZhLy0hJaBBDaiwnAeYHX1wL SafX7Y4ywwksasMM4OGOV2LuKss3LMP1pkScVqtrYOQvZxlnr1NGFvkhn+zfWAhV8JqxuOsRP DFhNRz8WWJeMSlqjtZwy4wbz5OTP4rCq/eDAWkV4EGloe7AaseyWvG7I51rxzwRsrYm1CiSS2 16z8d8K7hi7RM3+4WFiXnHxxgZaC+AVxLUHV2/FVDTUMh7vZPxaR6MPC4jHCtyewzdr+mDHca OkkSURN9otO4cMtRm3U3FaiphM+Pfu7UmKRVqCEyWpcdRRcM0wCfJpy92L/QNnANDZi95XtuL 9JiZk+xMEfcQbRqZIYXkQYWZ6OP2DoqSPowF0cds7UwZ9rEMg8ud9cXvm82ZYgo8ftbA8ZoWd C1VthxIEn60oO/jnNNZY7Al2seRlQ== Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org The Netlink interface for metering was restricted to global CAP_NET_ADMIN by using GENL_ADMIN_PERM. To allow metring in a non-inital user namespace, e.g., a container, this is changed to GENL_UNS_ADMIN_PERM. Signed-off-by: Michael Wei=C3=9F --- net/openvswitch/meter.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/net/openvswitch/meter.c b/net/openvswitch/meter.c index 51111a9009bd..6e38f68f88c2 100644 --- a/net/openvswitch/meter.c +++ b/net/openvswitch/meter.c @@ -343,7 +343,7 @@ static struct dp_meter *dp_meter_create(struct nlattr *= *a) return ERR_PTR(-EINVAL); =20 /* Allocate and set up the meter before locking anything. */ - meter =3D kzalloc(struct_size(meter, bands, n_bands), GFP_KERNEL); + meter =3D kzalloc(struct_size(meter, bands, n_bands), GFP_KERNEL_ACCOUNT); if (!meter) return ERR_PTR(-ENOMEM); =20 @@ -687,9 +687,9 @@ static const struct genl_small_ops dp_meter_genl_ops[] = =3D { }, { .cmd =3D OVS_METER_CMD_SET, .validate =3D GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, - .flags =3D GENL_ADMIN_PERM, /* Requires CAP_NET_ADMIN - * privilege. - */ + .flags =3D GENL_UNS_ADMIN_PERM, /* Requires CAP_NET_ADMIN + * privilege. + */ .doit =3D ovs_meter_cmd_set, }, { .cmd =3D OVS_METER_CMD_GET, @@ -699,9 +699,9 @@ static const struct genl_small_ops dp_meter_genl_ops[] = =3D { }, { .cmd =3D OVS_METER_CMD_DEL, .validate =3D GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, - .flags =3D GENL_ADMIN_PERM, /* Requires CAP_NET_ADMIN - * privilege. - */ + .flags =3D GENL_UNS_ADMIN_PERM, /* Requires CAP_NET_ADMIN + * privilege. + */ .doit =3D ovs_meter_cmd_del }, }; --=20 2.30.2 From nobody Fri Apr 26 02:44:57 2024 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2AA7EC6FA82 for ; Fri, 23 Sep 2022 13:39:35 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232187AbiIWNjd (ORCPT ); Fri, 23 Sep 2022 09:39:33 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51118 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231783AbiIWNj1 (ORCPT ); Fri, 23 Sep 2022 09:39:27 -0400 Received: from mout.kundenserver.de (mout.kundenserver.de [212.227.17.13]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id EE50A13BCEC; Fri, 23 Sep 2022 06:39:21 -0700 (PDT) Received: from weisslap.fritz.box ([31.19.218.61]) by mrelayeu.kundenserver.de (mreue107 [212.227.15.183]) with ESMTPSA (Nemesis) id 1MEF87-1oRVkB2g6P-00ABiH; Fri, 23 Sep 2022 15:39:02 +0200 From: =?UTF-8?q?Michael=20Wei=C3=9F?= To: Paolo Abeni , Pravin B Shelar , "David S . Miller" , Jakub Kicinski Cc: Joe Stringer , Andy Zhou , =?UTF-8?q?Michael=20Wei=C3=9F?= , Eric Dumazet , netdev@vger.kernel.org, dev@openvswitch.org, linux-kernel@vger.kernel.org Subject: [PATCH v3 net-next 2/2] net: openvswitch: allow conntrack in non-initial user namespace Date: Fri, 23 Sep 2022 15:38:20 +0200 Message-Id: <20220923133820.993725-3-michael.weiss@aisec.fraunhofer.de> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20220923133820.993725-1-michael.weiss@aisec.fraunhofer.de> References: <20220923133820.993725-1-michael.weiss@aisec.fraunhofer.de> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Provags-ID: V03:K1:LHiZC01TYNuQgQi1n7k4fjs48kn5evKqTxORFX0N4WGhIiWE1qt ytlmRPcQeMizccFmES5wgcNTy73yUGF1YYehKezF6UnKhoaDdy6RMYimmM5rpUkO2ChLYyO wuiFKVoh9BkATo37lKSMYqGIOcltEms47WoH0diAa9JHiPZlAa9v6g52Nd84mDQqg1kDBco eAPyAKiEIABd7x3Tpk2jA== X-UI-Out-Filterresults: notjunk:1;V03:K0:NoCYHAXAiuc=:BkTba5eXU+OtZQg/tp7Xf/ LPiN3nxlZB66+C5CPHChpTEAVl0ILzWTZFvYsuMV4MusszuRQiuD5ngdyVOLD+O3olIkF9Shi Ibd9vy9ROYLZe006fVOZiyHcKpkVVVstJiHO415iiA+bCnXanu5SQ9yxE+LqnThpzcCx1tLqC zMwRKzmzKnr6DeRJP2kF+h4pWlQWjivfZHBwNYM+yshldHlAbNgmvXQlZHSE/9+RTQWHU359j UJ+IUzWezMojl2SrSpCbXj5pQR+cERBrPVIlSXs5VNmd23ilQvRYAWE9Qbn0wNIWcohCtOv1g VJl2arIHAoXhzne3aYYQvPEzaEKMLcjXEk9HG5GHqo6Q7HyBxwQSg2wUb716Wacyws4PGUfyG q1UptSqcYaANoH6/V+0JibQhny1NgbJbf4cqAugCL4KFM2TkDZzPuWl5ZC2HiuSpLQ3R2vM1h 45FN5ws/KwSX3kkSns91oweWOiFHsuOKy4ztVTTk1qyxqwPQf6jdn/lQFn/VULQha0hhJEg45 TLvoE3IZY5Ok38iKZ5S+rwvKNqXinixCcektKi6KrC/u06rgdqJinv9FjTxjC4RromsG0SQyp uNclstL3Ul+4djrODCAyVvqVLOZ1jcZMjD8Rus2Dj9rlr8Tjbd69uuAyr+sQklDTYcujYXv3Z kXKh0D2bhdn5VuxDsbalzhvbFVKYwQcSePChm1Cgaltk3Ldi255l2O2AiI5PQSiCNfRStF4zS IF7b9ef8oRA5ICrRsvFlxeGna8aKEsx5+JLof3g9Lv3xZmoKF/t/r46PN0uvunbVbtlYX1WMW PPHmjNiYod+4QvRn0f2iquDR/L/BQ== Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Similar to the previous commit, the Netlink interface of the OVS conntrack module was restricted to global CAP_NET_ADMIN by using GENL_ADMIN_PERM. This is changed to GENL_UNS_ADMIN_PERM to support unprivileged containers in non-initial user namespace. Signed-off-by: Michael Wei=C3=9F --- net/openvswitch/conntrack.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c index 48e8f5c29b67..cb255d8ed99a 100644 --- a/net/openvswitch/conntrack.c +++ b/net/openvswitch/conntrack.c @@ -1982,7 +1982,8 @@ static int ovs_ct_limit_set_zone_limit(struct nlattr = *nla_zone_limit, } else { struct ovs_ct_limit *ct_limit; =20 - ct_limit =3D kmalloc(sizeof(*ct_limit), GFP_KERNEL); + ct_limit =3D kmalloc(sizeof(*ct_limit), + GFP_KERNEL_ACCOUNT); if (!ct_limit) return -ENOMEM; =20 @@ -2252,14 +2253,16 @@ static int ovs_ct_limit_cmd_get(struct sk_buff *skb= , struct genl_info *info) static const struct genl_small_ops ct_limit_genl_ops[] =3D { { .cmd =3D OVS_CT_LIMIT_CMD_SET, .validate =3D GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, - .flags =3D GENL_ADMIN_PERM, /* Requires CAP_NET_ADMIN - * privilege. */ + .flags =3D GENL_UNS_ADMIN_PERM, /* Requires CAP_NET_ADMIN + * privilege. + */ .doit =3D ovs_ct_limit_cmd_set, }, { .cmd =3D OVS_CT_LIMIT_CMD_DEL, .validate =3D GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, - .flags =3D GENL_ADMIN_PERM, /* Requires CAP_NET_ADMIN - * privilege. */ + .flags =3D GENL_UNS_ADMIN_PERM, /* Requires CAP_NET_ADMIN + * privilege. + */ .doit =3D ovs_ct_limit_cmd_del, }, { .cmd =3D OVS_CT_LIMIT_CMD_GET, --=20 2.30.2