Page MenuHomeFreeBSD

if_me: Use dedicated network privilege
ClosedPublic

Authored by zlei on Sep 25 2022, 4:42 AM.
Referenced Files
Unknown Object (File)
Fri, Oct 4, 10:05 AM
Unknown Object (File)
Tue, Sep 24, 4:34 PM
Unknown Object (File)
Tue, Sep 24, 4:34 PM
Unknown Object (File)
Tue, Sep 24, 2:36 PM
Unknown Object (File)
Wed, Sep 18, 1:35 AM
Unknown Object (File)
Tue, Sep 17, 11:54 PM
Unknown Object (File)
Sun, Sep 15, 10:31 PM
Unknown Object (File)
Sun, Sep 15, 10:14 PM

Details

Test Plan

Create a vnet jail, setup and config me(4) interface should succeed.

root@:~ # kldload if_me
root@:~ # jail -c path=/ name=test vnet persist 
root@:~ # jexec test sysctl net.fibs=2
net.fibs: 1 -> 2
root@:~ # jexec test ifconfig me create
me0
root@:~ # jexec test ifconfig me0 fib 1

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

zlei requested review of this revision.Sep 25 2022, 4:42 AM
sys/sys/priv.h
352

Conflict with PRIV_NET_WG introduced by ongoing D36909.

What problem does this fix? In other words, what is the motivation for this change?

Is there a use case for separating the GRE and ME privs? It's conceptually cleaner, but it could (theoretically at least, I doubt anyone actually does this) break existing configurations that rely on granting PRIV_NET_GRE to administer me interfaces.

In D36691#839695, @kp wrote:

What problem does this fix? In other words, what is the motivation for this change?

No known problems.
When I was trying to resolve https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=266712, I dug into the privileges design. I checked multiple tunnel interface implementations and found that if_me shares network privilege with if_gre. Intuitively this would confuse consumer. Fortunately there is no other consumers in base system.

Is there a use case for separating the GRE and ME privs? It's conceptually cleaner, but it could (theoretically at least, I doubt anyone actually does this) break existing configurations that rely on granting PRIV_NET_GRE to administer me interfaces.

There is no other consumers (of PRIV_NET_GRE) in base system, except for if_gre and if_me. I have not checked ports yet but it should be easy to fix ( in ports ).

It's conceptually cleaner

Yes +1.

This revision was not accepted when it landed; it landed in state Needs Review.Oct 15 2022, 3:23 PM
Closed by commit rG43f8c763cdee: if_me: Use dedicated network privilege (authored by zlei, committed by kp). · Explain Why
This revision was automatically updated to reflect the committed changes.