RDMA/uverbs: Check CAP_NET_RAW in user namespace for flow create

Currently, the capability check is done in the default
init_user_ns user namespace. When a process runs in a
non default user namespace, such check fails. Due to this
when a process is running using Podman, it fails to create
the flow resource.

Since the RDMA device is a resource within a network namespace,
use the network namespace associated with the RDMA device to
determine its owning user namespace.

Fixes: 436f2ad05a0b ("IB/core: Export ib_create/destroy_flow through uverbs")
Signed-off-by: Parav Pandit <parav@nvidia.com>
Suggested-by: Eric W. Biederman <ebiederm@xmission.com>
Link: https://patch.msgid.link/6df6f2f24627874c4f6d041c19dc1f6f29f68f84.1750963874.git.leon@kernel.org
Signed-off-by: Leon Romanovsky <leon@kernel.org>

diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c
index c0f8b8cba7c0eadc6321d89d1c268106c28dc169..1ca6a9b7ba1ac0bbd54ce9a65a05b40b1a391456 100644 (file)
--- a/drivers/infiniband/core/device.c
+++ b/drivers/infiniband/core/device.c
@@ -145,6 +145,33 @@ bool rdma_dev_access_netns(const struct ib_device *dev, const struct net *net)
 }
 EXPORT_SYMBOL(rdma_dev_access_netns);
 
+/**
+ * rdma_dev_has_raw_cap() - Returns whether a specified rdma device has
+ *                         CAP_NET_RAW capability or not.
+ *
+ * @dev:       Pointer to rdma device whose capability to be checked
+ *
+ * Returns true if a rdma device's owning user namespace has CAP_NET_RAW
+ * capability, otherwise false. When rdma subsystem is in legacy shared network,
+ * namespace mode, the default net namespace is considered.
+ */
+bool rdma_dev_has_raw_cap(const struct ib_device *dev)
+{
+       const struct net *net;
+
+       /* Network namespace is the resource whose user namespace
+        * to be considered. When in shared mode, there is no reliable
+        * network namespace resource, so consider the default net namespace.
+        */
+       if (ib_devices_shared_netns)
+               net = &init_net;
+       else
+               net = read_pnet(&dev->coredev.rdma_net);
+
+       return ns_capable(net->user_ns, CAP_NET_RAW);
+}
+EXPORT_SYMBOL(rdma_dev_has_raw_cap);
+
 /*
  * xarray has this behavior where it won't iterate over NULL values stored in
  * allocated arrays.  So we need our own iterator to see all values stored in

diff --git a/drivers/infiniband/core/rdma_core.c b/drivers/infiniband/core/rdma_core.c
index 90c177edf9b0d716e848cc7a99ea4131bd486b94..18918f4633614e74580e91c68dcef41fc8941a70 100644 (file)
--- a/drivers/infiniband/core/rdma_core.c
+++ b/drivers/infiniband/core/rdma_core.c
@@ -1019,3 +1019,32 @@ void uverbs_finalize_object(struct ib_uobject *uobj,
                WARN_ON(true);
        }
 }
+
+/**
+ * rdma_uattrs_has_raw_cap() - Returns whether a rdma device linked to the
+ *                            uverbs attributes file has CAP_NET_RAW
+ *                            capability or not.
+ *
+ * @attrs:       Pointer to uverbs attributes
+ *
+ * Returns true if a rdma device's owning user namespace has CAP_NET_RAW
+ * capability, otherwise false.
+ */
+bool rdma_uattrs_has_raw_cap(const struct uverbs_attr_bundle *attrs)
+{
+       struct ib_uverbs_file *ufile = attrs->ufile;
+       struct ib_ucontext *ucontext;
+       bool has_cap = false;
+       int srcu_key;
+
+       srcu_key = srcu_read_lock(&ufile->device->disassociate_srcu);
+       ucontext = ib_uverbs_get_ucontext_file(ufile);
+       if (IS_ERR(ucontext))
+               goto out;
+       has_cap = rdma_dev_has_raw_cap(ucontext->device);
+
+out:
+       srcu_read_unlock(&ufile->device->disassociate_srcu, srcu_key);
+       return has_cap;
+}
+EXPORT_SYMBOL(rdma_uattrs_has_raw_cap);

diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
index bc9fe3ceca4dbe95a6abdeccdd11a5fbe00c9ca0..6700c2c66167035f9e836459c500ce36195b39f0 100644 (file)
--- a/drivers/infiniband/core/uverbs_cmd.c
+++ b/drivers/infiniband/core/uverbs_cmd.c
@@ -3225,7 +3225,7 @@ static int ib_uverbs_ex_create_flow(struct uverbs_attr_bundle *attrs)
        if (cmd.comp_mask)
                return -EINVAL;
 
-       if (!capable(CAP_NET_RAW))
+       if (!rdma_uattrs_has_raw_cap(attrs))
                return -EPERM;
 
        if (cmd.flow_attr.flags >= IB_FLOW_ATTR_FLAGS_RESERVED)

diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h
index 7da27f01eeb6f32f721a0475737b94dc2ef67b74..010594dc755bc59a39fbe387de2a6e631c88c947 100644 (file)
--- a/include/rdma/ib_verbs.h
+++ b/include/rdma/ib_verbs.h
@@ -4817,6 +4817,8 @@ static inline int uverbs_destroy_def_handler(struct uverbs_attr_bundle *attrs)
 }
 #endif
 
+bool rdma_uattrs_has_raw_cap(const struct uverbs_attr_bundle *attrs);
+
 struct net_device *rdma_alloc_netdev(struct ib_device *device, u32 port_num,
                                     enum rdma_netdev_t type, const char *name,
                                     unsigned char name_assign_type,
@@ -4871,6 +4873,7 @@ static inline int ibdev_to_node(struct ib_device *ibdev)
 bool rdma_dev_access_netns(const struct ib_device *device,
                           const struct net *net);
 
+bool rdma_dev_has_raw_cap(const struct ib_device *dev);
 static inline struct net *rdma_dev_net(struct ib_device *device)
 {
        return read_pnet(&device->coredev.rdma_net);