Commit f458ccd2 authored by Parav Pandit's avatar Parav Pandit Committed by Leon Romanovsky
Browse files

RDMA/uverbs: Check CAP_NET_RAW in user namespace for flow create 



Currently, the capability check is done in the default
init_user_ns user namespace. When a process runs in a
non default user namespace, such check fails. Due to this
when a process is running using Podman, it fails to create
the flow resource.

Since the RDMA device is a resource within a network namespace,
use the network namespace associated with the RDMA device to
determine its owning user namespace.

Fixes: 436f2ad0 ("IB/core: Export ib_create/destroy_flow through uverbs")
Signed-off-by: default avatarParav Pandit <parav@nvidia.com>
Suggested-by: default avatarEric W. Biederman <ebiederm@xmission.com>
Link: https://patch.msgid.link/6df6f2f24627874c4f6d041c19dc1f6f29f68f84.1750963874.git.leon@kernel.org


Signed-off-by: default avatarLeon Romanovsky <leon@kernel.org>
parent f1208b05

drivers/infiniband/core/device.c

+27 −0
Original line number Diff line number Diff line
@@ -145,6 +145,33 @@ bool rdma_dev_access_netns(const struct ib_device *dev, const struct net *net) 
}

EXPORT_SYMBOL(rdma_dev_access_netns);



/**

 * rdma_dev_has_raw_cap() - Returns whether a specified rdma device has

 *			    CAP_NET_RAW capability or not.

 *

 * @dev:	Pointer to rdma device whose capability to be checked

 *

 * Returns true if a rdma device's owning user namespace has CAP_NET_RAW

 * capability, otherwise false. When rdma subsystem is in legacy shared network,

 * namespace mode, the default net namespace is considered.

 */

bool rdma_dev_has_raw_cap(const struct ib_device *dev)

{

	const struct net *net;



	/* Network namespace is the resource whose user namespace

	 * to be considered. When in shared mode, there is no reliable

	 * network namespace resource, so consider the default net namespace.

	 */

	if (ib_devices_shared_netns)

		net = &init_net;

	else

		net = read_pnet(&dev->coredev.rdma_net);



	return ns_capable(net->user_ns, CAP_NET_RAW);

}

EXPORT_SYMBOL(rdma_dev_has_raw_cap);



/*

 * xarray has this behavior where it won't iterate over NULL values stored in

 * allocated arrays.  So we need our own iterator to see all values stored in

drivers/infiniband/core/rdma_core.c

+29 −0
Original line number Diff line number Diff line
@@ -1019,3 +1019,32 @@ void uverbs_finalize_object(struct ib_uobject *uobj, 
		WARN_ON(true);

	}

}



/**

 * rdma_uattrs_has_raw_cap() - Returns whether a rdma device linked to the

 *			       uverbs attributes file has CAP_NET_RAW

 *			       capability or not.

 *

 * @attrs:       Pointer to uverbs attributes

 *

 * Returns true if a rdma device's owning user namespace has CAP_NET_RAW

 * capability, otherwise false.

 */

bool rdma_uattrs_has_raw_cap(const struct uverbs_attr_bundle *attrs)

{

	struct ib_uverbs_file *ufile = attrs->ufile;

	struct ib_ucontext *ucontext;

	bool has_cap = false;

	int srcu_key;



	srcu_key = srcu_read_lock(&ufile->device->disassociate_srcu);

	ucontext = ib_uverbs_get_ucontext_file(ufile);

	if (IS_ERR(ucontext))

		goto out;

	has_cap = rdma_dev_has_raw_cap(ucontext->device);



out:

	srcu_read_unlock(&ufile->device->disassociate_srcu, srcu_key);

	return has_cap;

}

EXPORT_SYMBOL(rdma_uattrs_has_raw_cap);

drivers/infiniband/core/uverbs_cmd.c

+1 −1
Original line number Diff line number Diff line
@@ -3225,7 +3225,7 @@ static int ib_uverbs_ex_create_flow(struct uverbs_attr_bundle *attrs) 
	if (cmd.comp_mask)

		return -EINVAL;



	if (!capable(CAP_NET_RAW))

	if (!rdma_uattrs_has_raw_cap(attrs))

		return -EPERM;



	if (cmd.flow_attr.flags >= IB_FLOW_ATTR_FLAGS_RESERVED)

include/rdma/ib_verbs.h

+3 −0
Original line number Diff line number Diff line
@@ -4817,6 +4817,8 @@ static inline int uverbs_destroy_def_handler(struct uverbs_attr_bundle *attrs) 
}

#endif



bool rdma_uattrs_has_raw_cap(const struct uverbs_attr_bundle *attrs);



struct net_device *rdma_alloc_netdev(struct ib_device *device, u32 port_num,

				     enum rdma_netdev_t type, const char *name,

				     unsigned char name_assign_type,
@@ -4871,6 +4873,7 @@ static inline int ibdev_to_node(struct ib_device *ibdev) 
bool rdma_dev_access_netns(const struct ib_device *device,

			   const struct net *net);



bool rdma_dev_has_raw_cap(const struct ib_device *dev);

static inline struct net *rdma_dev_net(struct ib_device *device)

{

	return read_pnet(&device->coredev.rdma_net);