if_me: Use dedicated network privilege
ClosedPublic
Actions

Authored by zlei on Sep 25 2022, 4:42 AM.

Details

Reviewers

Group Reviewers

network

Commits

rG92de6be41ef4: if_me: Use dedicated network privilege
rG310f6f2448ed: if_me: Use dedicated network privilege
rG43f8c763cdee: if_me: Use dedicated network privilege

Test Plan

Create a vnet jail, setup and config me(4) interface should succeed.

root@:~ # kldload if_me
root@:~ # jail -c path=/ name=test vnet persist 
root@:~ # jexec test sysctl net.fibs=2
net.fibs: 1 -> 2
root@:~ # jexec test ifconfig me create
me0
root@:~ # jexec test ifconfig me0 fib 1

Diff Detail

Repository

rG FreeBSD src repository

Lint

Lint Not Applicable

Unit

Tests Not Applicable

Event Timeline

zlei created this revision.Sep 25 2022, 4:42 AM

Herald added subscribers: glebius, melifaro, imp. · View Herald TranscriptSep 25 2022, 4:42 AM

zlei requested review of this revision.Sep 25 2022, 4:42 AM

zlei added inline comments.Oct 9 2022, 1:12 AM

sys/sys/priv.h
352	Conflict with `PRIV_NET_WG` introduced by ongoing D36909.

What problem does this fix? In other words, what is the motivation for this change?

Is there a use case for separating the GRE and ME privs? It's conceptually cleaner, but it could (theoretically at least, I doubt anyone actually does this) break existing configurations that rely on granting PRIV_NET_GRE to administer me interfaces.

In D36691#839695, @kp wrote:

What problem does this fix? In other words, what is the motivation for this change?

No known problems.
When I was trying to resolve https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=266712, I dug into the privileges design. I checked multiple tunnel interface implementations and found that if_me shares network privilege with if_gre. Intuitively this would confuse consumer. Fortunately there is no other consumers in base system.

Is there a use case for separating the GRE and ME privs? It's conceptually cleaner, but it could (theoretically at least, I doubt anyone actually does this) break existing configurations that rely on granting PRIV_NET_GRE to administer me interfaces.

There is no other consumers (of PRIV_NET_GRE) in base system, except for if_gre and if_me. I have not checked ports yet but it should be easy to fix ( in ports ).