From nobody Mon Jun 8 08:54:32 2026 Received: from mail-wm1-f53.google.com (mail-wm1-f53.google.com [209.85.128.53]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6C7CE3B1EFE for ; Thu, 4 Jun 2026 16:31:12 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.53 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780590674; cv=none; b=LbJf3HfQD2LxvLZwUhWMzzyezzEKYYbgqCywxJ4h2BzhDah0ZROPJOmBwqUxj4lMc9B3w5jm8+VONKV6lHBzbP29Axe8LhKucYlppqSrIAXFbXt5qP1TagnDd6/JhV/Wg7J3wL8WBpAyKq91n4Zpg55RFO886e/9eByzeETkEvM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780590674; c=relaxed/simple; bh=E+CY1M4wlSS+01/WXaewcF4d2P9oQida5I0nhuFHPIc=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=b8LnDw16IHCPTgi9tjK+Gu4sc6GxJ0fVFpCPnUsg4+5e6Uti6lmERnMauMP/Bx87il6Ug/FW8LjxCGpAafbetfL2TSNYGdNr7fU9dLSmbOI2o2BSGLtXct1/LeAP+CMHwmpvzx73QAZF6twWZ/LoCPqRaC1s1JjV79bNhz3jrBA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=trailofbits.com; spf=pass smtp.mailfrom=trailofbits.com; dkim=pass (2048-bit key) header.d=trailofbits.com header.i=@trailofbits.com header.b=NUzI+k8P; arc=none smtp.client-ip=209.85.128.53 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=trailofbits.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=trailofbits.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=trailofbits.com header.i=@trailofbits.com header.b="NUzI+k8P" Received: by mail-wm1-f53.google.com with SMTP id 5b1f17b1804b1-490abf12f0fso5244195e9.0 for ; Thu, 04 Jun 2026 09:31:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=trailofbits.com; s=google; t=1780590671; x=1781195471; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=k/GEJPOLrP92/aFR0MWS+Y1Uq69OUcBYv6uQ0YsT5bY=; b=NUzI+k8P5Zwls7EyjHD88tj8+O4YO48ZQEx5xTH0Tmn3QBVsdHKQRA2Ez5lIfLdT97 Pzr54+7ZCX488AtaSiRejZxhBBG40mQIxBBdyy2HTv/Fv8PfDzgalyp+3w7OaDHfYe5o GF+mGY93AnRE9vW7I1adhHWYpizQg8cU6drJcYPYVgHTEUzERL09LSwk6pt3dXuLCCkZ izIPxeiU4ITy5xiQ0psVyvcGlHYsIqsODpWDKEWkfXLQ6gKjt7QzrmxXuPTSvioHfE3V alEuv5K2tvs7bUzMxrNajs9IxYzNFVgJGMKRBj0sWVECEIji8CysJRbvAxuN2ATczH69 Zsfw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1780590671; x=1781195471; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=k/GEJPOLrP92/aFR0MWS+Y1Uq69OUcBYv6uQ0YsT5bY=; b=l3BqUH/oy/HeLjQDCZAwaI44QGBDPCNwwVRzaZzlLR6bG+874sdy+U63WaaDlxQjoI fTPWw4KonYH9t8lwVYEjCDv1p0JHVm7Ok9f04cVlGx2fPVJqguAZR0iCPoYzXW8cdDLc silG7O9vLxDm+4rISFc1I15qgjBQHnwS/gTPO2CEMEWE/AqyCtaCfj9tan+c5OtQwPgE mQesw31l/k/av8mRd7Sx/fXHIotX0ki8UO8QmvRr1QYb2n8/93aEVKcc5sDU5gqAWplW d0zvfrp8TaAwf7//Z1tL3Cj9gtxNZyDHnEit4b7REHgVvYjhxwYmS//Gmz/hSsFSxp1p YU0A== X-Forwarded-Encrypted: i=1; AFNElJ/wh3A2hd79Gba7z9r0BL1PV5LKwq4W91v3TH4FVfnGV/C2OLVIJ6IZZkn3aU4DhJE4hPBOWXZowC1NSlg=@vger.kernel.org X-Gm-Message-State: AOJu0Yy9XtJ/n70pGAUFqg3TTUn5eA9aNY9FWQSxsdZ6mZjT5/VTbMkg vSeTAbsYUQHoWeg3nICk21KIJndU86v+PEoN0fP10m7+BJP240+luVKuTkYS36K435M= X-Gm-Gg: Acq92OFvX1N3zCiIdzTJIMTvzZV0+kQJk4taiWtJxigN5mY/fIPCjLe73dsoqXP7zhq 8Ec+UQF5lSHW+6BgaHLZCgcyapI8qlIIoc7nBKdATdZwf+he7+JeVqqHy9jxOVCj9OMv+qJ51vX +LcIygF5cO3GR9F1gMGdrdcXpqUNTHQpRoUFPcoJGrbjzSxnWOWxTCV/esHuWsrLqYV7SeQ0zxJ StnpuOzOhb0cAYFx94NDugQLTug31d+5WpkGaUWDC8no3t6ripYOaeGqVL4L3Kwo/3tueFRMGm1 YZn3TXjnWiOQdkR45FTMYpw6Go0+rwLAdp6thpvDNwiq9dQIZgOlkSe0hyJk0JyZ5nLtu+iCyTL FDRtqeTIGT6npOs50DU9f45uI0a0UGyxVnd7wgM7B1eSZulh7d4fy0uneEnYF4jYYy3fcYFl2pO ueVy5utSV1qsxfzrODyXJ/1Wn4od1beGhCvRXV96Wg2UjQINWvEjgqhFWBrwu0L4pwUQftr+3yU H/9Uw== X-Received: by 2002:a05:600c:3155:b0:490:b4a8:e031 with SMTP id 5b1f17b1804b1-490bc4c4b62mr64777715e9.4.1780590670952; Thu, 04 Jun 2026 09:31:10 -0700 (PDT) Received: from localhost ([46.101.197.76]) by smtp.gmail.com with UTF8SMTPSA id ffacd0b85a97d-46028a6dcbdsm8063435f8f.7.2026.06.04.09.31.09 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Thu, 04 Jun 2026 09:31:10 -0700 (PDT) From: Dominik 'Disconnect3d' Czarnota To: Jon Maloy , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , netdev@vger.kernel.org Cc: Dominik 'Disconnect3d' Czarnota , Simon Horman , Richard Alpe , Erik Hugne , Ying Xue , tipc-discussion@lists.sourceforge.net, linux-kernel@vger.kernel.org Subject: [PATCH net] tipc: require admin privileges for TIPCv2 mutators Date: Thu, 4 Jun 2026 16:31:01 +0000 Message-ID: <20260604163102.2658553-1-dominik.czarnota@trailofbits.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" TIPCv2 registers its generic-netlink mutating commands without permission flags. Generic netlink only checks CAP_NET_ADMIN when an operation carries GENL_ADMIN_PERM or GENL_UNS_ADMIN_PERM, so callers without CAP_NET_ADMIN can invoke these setters. This allows an unprivileged caller to change TIPC control-plane state, including bearer, link, network, monitor, peer and crypto-key state. TIPC_NL_MEDIA_SET is broader because it updates the shared media defaults returned by tipc_media_find(), including UDP MTU, priority, tolerance and window values, which can affect later bearer setup. Require CAP_NET_ADMIN for all TIPCv2 mutators. Use GENL_UNS_ADMIN_PERM for network-namespace scoped state, matching the legacy compat path and normal netns administration semantics. Use GENL_ADMIN_PERM for TIPC_NL_MEDIA_SET because it mutates global media defaults rather than state owned only by the target net namespace. Fixes: 0655f6a8635b ("tipc: add bearer disable/enable to new netlink api") Assisted-by: Codex:gpt-5.5-cyber-preview Signed-off-by: Dominik 'Disconnect3d' Czarnota --- net/tipc/netlink.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/net/tipc/netlink.c b/net/tipc/netlink.c index 1a9a5bdaccf4..5bbe134284ac 100644 --- a/net/tipc/netlink.c +++ b/net/tipc/netlink.c @@ -152,11 +152,13 @@ static const struct genl_ops tipc_genl_v2_ops[] =3D { { .cmd =3D TIPC_NL_BEARER_DISABLE, .validate =3D GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, + .flags =3D GENL_UNS_ADMIN_PERM, .doit =3D tipc_nl_bearer_disable, }, { .cmd =3D TIPC_NL_BEARER_ENABLE, .validate =3D GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, + .flags =3D GENL_UNS_ADMIN_PERM, .doit =3D tipc_nl_bearer_enable, }, { @@ -168,11 +170,13 @@ static const struct genl_ops tipc_genl_v2_ops[] =3D { { .cmd =3D TIPC_NL_BEARER_ADD, .validate =3D GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, + .flags =3D GENL_UNS_ADMIN_PERM, .doit =3D tipc_nl_bearer_add, }, { .cmd =3D TIPC_NL_BEARER_SET, .validate =3D GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, + .flags =3D GENL_UNS_ADMIN_PERM, .doit =3D tipc_nl_bearer_set, }, { @@ -197,11 +201,13 @@ static const struct genl_ops tipc_genl_v2_ops[] =3D { { .cmd =3D TIPC_NL_LINK_SET, .validate =3D GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, + .flags =3D GENL_UNS_ADMIN_PERM, .doit =3D tipc_nl_node_set_link, }, { .cmd =3D TIPC_NL_LINK_RESET_STATS, .validate =3D GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, + .flags =3D GENL_UNS_ADMIN_PERM, .doit =3D tipc_nl_node_reset_link_stats, }, { @@ -213,6 +219,7 @@ static const struct genl_ops tipc_genl_v2_ops[] =3D { { .cmd =3D TIPC_NL_MEDIA_SET, .validate =3D GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, + .flags =3D GENL_ADMIN_PERM, .doit =3D tipc_nl_media_set, }, { @@ -228,6 +235,7 @@ static const struct genl_ops tipc_genl_v2_ops[] =3D { { .cmd =3D TIPC_NL_NET_SET, .validate =3D GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, + .flags =3D GENL_UNS_ADMIN_PERM, .doit =3D tipc_nl_net_set, }, { @@ -238,6 +246,7 @@ static const struct genl_ops tipc_genl_v2_ops[] =3D { { .cmd =3D TIPC_NL_MON_SET, .validate =3D GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, + .flags =3D GENL_UNS_ADMIN_PERM, .doit =3D tipc_nl_node_set_monitor, }, { @@ -255,6 +264,7 @@ static const struct genl_ops tipc_genl_v2_ops[] =3D { { .cmd =3D TIPC_NL_PEER_REMOVE, .validate =3D GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, + .flags =3D GENL_UNS_ADMIN_PERM, .doit =3D tipc_nl_peer_rm, }, #ifdef CONFIG_TIPC_MEDIA_UDP @@ -269,11 +279,13 @@ static const struct genl_ops tipc_genl_v2_ops[] =3D { { .cmd =3D TIPC_NL_KEY_SET, .validate =3D GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, + .flags =3D GENL_UNS_ADMIN_PERM, .doit =3D tipc_nl_node_set_key, }, { .cmd =3D TIPC_NL_KEY_FLUSH, .validate =3D GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, + .flags =3D GENL_UNS_ADMIN_PERM, .doit =3D tipc_nl_node_flush_key, }, #endif