mirror of
git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
synced 2025-09-04 20:19:47 +08:00
RDMA/uverbs: Check CAP_NET_RAW in user namespace for flow create
Currently, the capability check is done in the default
init_user_ns user namespace. When a process runs in a
non default user namespace, such check fails. Due to this
when a process is running using Podman, it fails to create
the flow resource.
Since the RDMA device is a resource within a network namespace,
use the network namespace associated with the RDMA device to
determine its owning user namespace.
Fixes: 436f2ad05a
("IB/core: Export ib_create/destroy_flow through uverbs")
Signed-off-by: Parav Pandit <parav@nvidia.com>
Suggested-by: Eric W. Biederman <ebiederm@xmission.com>
Link: https://patch.msgid.link/6df6f2f24627874c4f6d041c19dc1f6f29f68f84.1750963874.git.leon@kernel.org
Signed-off-by: Leon Romanovsky <leon@kernel.org>
This commit is contained in:
parent
f1208b0557
commit
f458ccd2aa
@ -145,6 +145,33 @@ bool rdma_dev_access_netns(const struct ib_device *dev, const struct net *net)
|
||||
}
|
||||
EXPORT_SYMBOL(rdma_dev_access_netns);
|
||||
|
||||
/**
|
||||
* rdma_dev_has_raw_cap() - Returns whether a specified rdma device has
|
||||
* CAP_NET_RAW capability or not.
|
||||
*
|
||||
* @dev: Pointer to rdma device whose capability to be checked
|
||||
*
|
||||
* Returns true if a rdma device's owning user namespace has CAP_NET_RAW
|
||||
* capability, otherwise false. When rdma subsystem is in legacy shared network,
|
||||
* namespace mode, the default net namespace is considered.
|
||||
*/
|
||||
bool rdma_dev_has_raw_cap(const struct ib_device *dev)
|
||||
{
|
||||
const struct net *net;
|
||||
|
||||
/* Network namespace is the resource whose user namespace
|
||||
* to be considered. When in shared mode, there is no reliable
|
||||
* network namespace resource, so consider the default net namespace.
|
||||
*/
|
||||
if (ib_devices_shared_netns)
|
||||
net = &init_net;
|
||||
else
|
||||
net = read_pnet(&dev->coredev.rdma_net);
|
||||
|
||||
return ns_capable(net->user_ns, CAP_NET_RAW);
|
||||
}
|
||||
EXPORT_SYMBOL(rdma_dev_has_raw_cap);
|
||||
|
||||
/*
|
||||
* xarray has this behavior where it won't iterate over NULL values stored in
|
||||
* allocated arrays. So we need our own iterator to see all values stored in
|
||||
|
@ -1019,3 +1019,32 @@ void uverbs_finalize_object(struct ib_uobject *uobj,
|
||||
WARN_ON(true);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* rdma_uattrs_has_raw_cap() - Returns whether a rdma device linked to the
|
||||
* uverbs attributes file has CAP_NET_RAW
|
||||
* capability or not.
|
||||
*
|
||||
* @attrs: Pointer to uverbs attributes
|
||||
*
|
||||
* Returns true if a rdma device's owning user namespace has CAP_NET_RAW
|
||||
* capability, otherwise false.
|
||||
*/
|
||||
bool rdma_uattrs_has_raw_cap(const struct uverbs_attr_bundle *attrs)
|
||||
{
|
||||
struct ib_uverbs_file *ufile = attrs->ufile;
|
||||
struct ib_ucontext *ucontext;
|
||||
bool has_cap = false;
|
||||
int srcu_key;
|
||||
|
||||
srcu_key = srcu_read_lock(&ufile->device->disassociate_srcu);
|
||||
ucontext = ib_uverbs_get_ucontext_file(ufile);
|
||||
if (IS_ERR(ucontext))
|
||||
goto out;
|
||||
has_cap = rdma_dev_has_raw_cap(ucontext->device);
|
||||
|
||||
out:
|
||||
srcu_read_unlock(&ufile->device->disassociate_srcu, srcu_key);
|
||||
return has_cap;
|
||||
}
|
||||
EXPORT_SYMBOL(rdma_uattrs_has_raw_cap);
|
||||
|
@ -3225,7 +3225,7 @@ static int ib_uverbs_ex_create_flow(struct uverbs_attr_bundle *attrs)
|
||||
if (cmd.comp_mask)
|
||||
return -EINVAL;
|
||||
|
||||
if (!capable(CAP_NET_RAW))
|
||||
if (!rdma_uattrs_has_raw_cap(attrs))
|
||||
return -EPERM;
|
||||
|
||||
if (cmd.flow_attr.flags >= IB_FLOW_ATTR_FLAGS_RESERVED)
|
||||
|
@ -4817,6 +4817,8 @@ static inline int uverbs_destroy_def_handler(struct uverbs_attr_bundle *attrs)
|
||||
}
|
||||
#endif
|
||||
|
||||
bool rdma_uattrs_has_raw_cap(const struct uverbs_attr_bundle *attrs);
|
||||
|
||||
struct net_device *rdma_alloc_netdev(struct ib_device *device, u32 port_num,
|
||||
enum rdma_netdev_t type, const char *name,
|
||||
unsigned char name_assign_type,
|
||||
@ -4871,6 +4873,7 @@ static inline int ibdev_to_node(struct ib_device *ibdev)
|
||||
bool rdma_dev_access_netns(const struct ib_device *device,
|
||||
const struct net *net);
|
||||
|
||||
bool rdma_dev_has_raw_cap(const struct ib_device *dev);
|
||||
static inline struct net *rdma_dev_net(struct ib_device *device)
|
||||
{
|
||||
return read_pnet(&device->coredev.rdma_net);
|
||||
|
Loading…
Reference in New Issue
Block a user