bybrooklyn/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-04-18 06:44:00 -04:00
Code Issues Packages Projects Releases Wiki Activity

RDMA/uverbs: Check CAP_NET_RAW in user namespace for flow create

Browse Source 
Currently, the capability check is done in the default
init_user_ns user namespace. When a process runs in a
non default user namespace, such check fails. Due to this
when a process is running using Podman, it fails to create
the flow resource.

Since the RDMA device is a resource within a network namespace,
use the network namespace associated with the RDMA device to
determine its owning user namespace.

Fixes: 436f2ad05a ("IB/core: Export ib_create/destroy_flow through uverbs")
Signed-off-by: Parav Pandit <parav@nvidia.com>
Suggested-by: Eric W. Biederman <ebiederm@xmission.com>
Link: https://patch.msgid.link/6df6f2f24627874c4f6d041c19dc1f6f29f68f84.1750963874.git.leon@kernel.org
Signed-off-by: Leon Romanovsky <leon@kernel.org>
This commit is contained in:
Parav Pandit
2025-06-26 21:58:04 +03:00
committed by Leon Romanovsky
parent f1208b0557
commit f458ccd2aa
4 changed files with 60 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
include/rdma/ib_verbs.h
View File

@@ -4817,6 +4817,8 @@ static inline int uverbs_destroy_def_handler(struct uverbs_attr_bundle *attrs)
}
#endif
bool rdma_uattrs_has_raw_cap(const struct uverbs_attr_bundle *attrs);
struct net_device *rdma_alloc_netdev(struct ib_device *device, u32 port_num,
enum rdma_netdev_t type, const char *name,
unsigned char name_assign_type,
@@ -4871,6 +4873,7 @@ static inline int ibdev_to_node(struct ib_device *ibdev)
bool rdma_dev_access_netns(const struct ib_device *device,
const struct net *net);
bool rdma_dev_has_raw_cap(const struct ib_device *dev);
static inline struct net *rdma_dev_net(struct ib_device *device)
{
return read_pnet(&device->coredev.rdma_net);