Page MenuHomeFreeBSD

ip_mroute: Make privilege checking more consistent
ClosedPublic

Authored by markj on Jan 30 2026, 8:47 PM.
Tags
None
Referenced Files
Unknown Object (File)
Mon, Mar 2, 2:21 PM
Unknown Object (File)
Tue, Feb 24, 12:22 AM
Unknown Object (File)
Tue, Feb 17, 10:44 PM
Unknown Object (File)
Sat, Feb 14, 11:43 PM
Unknown Object (File)
Sat, Feb 14, 1:06 AM
Unknown Object (File)
Thu, Feb 12, 7:15 AM
Unknown Object (File)
Feb 2 2026, 2:08 AM
Unknown Object (File)
Feb 1 2026, 1:15 PM

Details

Summary
  • The v6 socket option and ioctl handlers had no privilege checks at all. The socket options, I believe, can only be reached via a raw socket, but a jailed root user with a raw socket shouldn't be able to configure multicast routing in a non-VNET jail. The ioctls can only be used to fetch stats.
  • Delete a bogus comment in X_mrt_ioctl(), one can issue multicast routing ioctls against any socket. Note that the call path is soo_ioctl()->rtioctl_fib()->mrt_ioctl().

I think all of the mroute privilege checks should be done within the
ip(6)_mroute code, but let's first make the v4 and v6 modules
consistent.

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

markj requested review of this revision.Jan 30 2026, 8:47 PM
glebius added inline comments.
sys/netinet6/ip6_mroute.c
467–481

More lapidary version

This revision is now accepted and ready to land.Jan 30 2026, 9:41 PM
sys/netinet6/ip6_mroute.c
467–481

Yeah, but I also want to keep the style consistent between the v4 and v6 code.

I have some further changes to these files coming (FIB-aware multicast routing tables) and will make this change in a later patch.