Date: Mon, 16 Feb 2026 15:44:33 +0000 From: Mark Johnston <markj@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Subject: git: bba9e2072966 - stable/15 - ip_mroute: Make privilege checking more consistent Message-ID: <69933b61.20867.7b95d192@gitrepo.freebsd.org>
index | next in thread | raw e-mail
The branch stable/15 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=bba9e20729660da478743d9965a11717fde56484 commit bba9e20729660da478743d9965a11717fde56484 Author: Mark Johnston <markj@FreeBSD.org> AuthorDate: 2026-02-02 14:53:35 +0000 Commit: Mark Johnston <markj@FreeBSD.org> CommitDate: 2026-02-16 13:46:36 +0000 ip_mroute: Make privilege checking more consistent - The v6 socket option and ioctl handlers had no privilege checks at all. The socket options, I believe, can only be reached via a raw socket, but a jailed root user with a raw socket shouldn't be able to configure multicast routing in a non-VNET jail. The ioctls can only be used to fetch stats. - Delete a bogus comment in X_mrt_ioctl(), one can issue multicast routing ioctls against any socket. Note that the call path is soo_ioctl()->rtioctl_fib()->mrt_ioctl(). I think all of the mroute privilege checks should be done within the ip(6)_mroute code, but let's first make the v4 and v6 modules consistent. Reviewed by: glebius MFC after: 2 weeks Sponsored by: Stormshield Sponsored by: Klara, Inc. Differential Revision: https://reviews.freebsd.org/D54982 (cherry picked from commit 74839871be363c5c2ac7ccd3396f36bdb58d19de) --- sys/netinet/ip_mroute.c | 5 ----- sys/netinet6/ip6_mroute.c | 15 +++++++++------ sys/netinet6/raw_ip6.c | 6 ++++++ 3 files changed, 15 insertions(+), 11 deletions(-) diff --git a/sys/netinet/ip_mroute.c b/sys/netinet/ip_mroute.c index 73f17adf5728..c69f3cc8b41e 100644 --- a/sys/netinet/ip_mroute.c +++ b/sys/netinet/ip_mroute.c @@ -547,11 +547,6 @@ X_mrt_ioctl(u_long cmd, caddr_t data, int fibnum __unused) { int error; - /* - * Currently the only function calling this ioctl routine is rtioctl_fib(). - * Typically, only root can create the raw socket in order to execute - * this ioctl method, however the request might be coming from a prison - */ error = priv_check(curthread, PRIV_NETINET_MROUTE); if (error) return (error); diff --git a/sys/netinet6/ip6_mroute.c b/sys/netinet6/ip6_mroute.c index 275c3ae2d7f1..5b9330c290d7 100644 --- a/sys/netinet6/ip6_mroute.c +++ b/sys/netinet6/ip6_mroute.c @@ -90,6 +90,7 @@ #include <sys/mbuf.h> #include <sys/module.h> #include <sys/domain.h> +#include <sys/priv.h> #include <sys/protosw.h> #include <sys/sdt.h> #include <sys/signalvar.h> @@ -457,24 +458,26 @@ X_ip6_mrouter_get(struct socket *so, struct sockopt *sopt) static int X_mrt6_ioctl(u_long cmd, caddr_t data) { - int ret; - - ret = EINVAL; + int error; + error = priv_check(curthread, PRIV_NETINET_MROUTE); + if (error) + return (error); + error = EINVAL; switch (cmd) { case SIOCGETSGCNT_IN6: - ret = get_sg_cnt((struct sioc_sg_req6 *)data); + error = get_sg_cnt((struct sioc_sg_req6 *)data); break; case SIOCGETMIFCNT_IN6: - ret = get_mif6_cnt((struct sioc_mif_req6 *)data); + error = get_mif6_cnt((struct sioc_mif_req6 *)data); break; default: break; } - return (ret); + return (error); } /* diff --git a/sys/netinet6/raw_ip6.c b/sys/netinet6/raw_ip6.c index c90a1213bd66..7deb605c07a2 100644 --- a/sys/netinet6/raw_ip6.c +++ b/sys/netinet6/raw_ip6.c @@ -604,6 +604,9 @@ rip6_ctloutput(struct socket *so, struct sockopt *sopt) case MRT6_ADD_MFC: case MRT6_DEL_MFC: case MRT6_PIM: + error = priv_check(curthread, PRIV_NETINET_MROUTE); + if (error != 0) + return (error); if (inp->inp_ip_p != IPPROTO_ICMPV6) return (EOPNOTSUPP); error = ip6_mrouter_get ? ip6_mrouter_get(so, sopt) : @@ -627,6 +630,9 @@ rip6_ctloutput(struct socket *so, struct sockopt *sopt) case MRT6_ADD_MFC: case MRT6_DEL_MFC: case MRT6_PIM: + error = priv_check(curthread, PRIV_NETINET_MROUTE); + if (error != 0) + return (error); if (inp->inp_ip_p != IPPROTO_ICMPV6) return (EOPNOTSUPP); error = ip6_mrouter_set ? ip6_mrouter_set(so, sopt) :home | help
Want to link to this message? Use this
URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?69933b61.20867.7b95d192>