From nobody Mon Aug 3 16:02:24 2026 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hDLzN57wtz6mRCL for ; Mon, 03 Aug 2026 16:02:24 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hDLzN2hKhz3PQL for ; Mon, 03 Aug 2026 16:02:24 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1785772944; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=igUskt5q5HbAAhdEHxaLZ87gpe3k84vGGSnpIQreGVk=; b=J5Dv3QM1X2ST1/Crme7mnXdl2GDQKahNirIKCa4ZFwwFpjeboFaJ3jXGUu0N1uopulAUaD aZTC/5F+3DInLjl2LEJSZJBVWt3+YNF38zYPukIrfvzIh/+AzVXYH7lK6EmEKd7u4Nryfl no9mykbr9eS7Ikgfviglsg+W1+k5DiqS/fJIoQgtHubM/szvchrdMGMPzBW7XuS+zu/vhh C3dpaSeyvti4HuVoGtQ4mg6KBVMLCcQjae6WVEw0ZbADgNF4VQuUVe2UlafYU0HJbE5Yv0 FQsR0ZMm6zrPrbEiQ5eGbP6doPLKrKSoqIIbF5r7MFHo3Rs5bUsNbuwALeKrLA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1785772944; a=rsa-sha256; cv=none; b=Efr25a+siRAMcWFDgnBGrErpqKZ1esX/X8K+rlxgPdA9K4jazmReJCr64xeVmqsuthDj6Q MBDJjNgsniADlmK4Ajhc+II2owUnxJhHtFWFSwqWY9Yl1XqU1pXSSiVr11AsABgpt+ZBth nZdoTfu3/kYjba8opkC+jugYreRnn/WZUtBq+DDhUUD84jpS0D8Sm4CyXCU8xjxOO7HUtj ujlGYckepKxMYmsm5nE9hT2lXBeGxzFK0T8paCwyafLHn5TV0TKZwxObWBkshiCRv01uG6 mj4fJk5PIkThDTwyJ5uhYXRHwlmFBEbuMy6u6vBoVVdbe7xOnlhYBwhZBz2lSQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1785772944; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=igUskt5q5HbAAhdEHxaLZ87gpe3k84vGGSnpIQreGVk=; b=KUYoPdKxGw9N+aMRXAL9wdR6GNPHHsZh/qaDsgbrFHjGSYqeGIuQUqsK1AcQ+76uds4oEQ 2pOGEbxaGMHSJvHQoPT1nJCTPR9/1TEpboxVj33CJ85iblQgWOaZ6hmlkDvOceM4klnX5R V2vo1mglakugxSlMv+iLmDXkI05m81APoYxVdQVlfyhyZ3dZDNXDIMgRH8/RJIjSs9pHUj RLteIKA2n8CmvsR7i9WWv4oKEqSt/YOEsbr8t9lTafxS29g9f5gd6VAePGrS3vwGWSsZF+ nRx6vQYu747DqyNqCq7v8Cau3MXEpwWSluaJHk1bk8IGI5TORnC7Oo8F7yl6fA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hDLzN1h3lz16gl for ; Mon, 03 Aug 2026 16:02:24 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3ef6d by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 03 Aug 2026 16:02:24 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Kristof Provost Subject: git: d13dffa150d1 - main - pf: fix securelevel off-by-one List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-main@freebsd.org Sender: owner-dev-commits-src-main@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kp X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: d13dffa150d17dc239e164ea42ddab91e6fab466 Auto-Submitted: auto-generated Date: Mon, 03 Aug 2026 16:02:24 +0000 Message-Id: <6a70bb90.3ef6d.21170ce2@gitrepo.freebsd.org> The branch main has been updated by kp: URL: https://cgit.FreeBSD.org/src/commit/?id=d13dffa150d17dc239e164ea42ddab91e6fab466 commit d13dffa150d17dc239e164ea42ddab91e6fab466 Author: Kristof Provost AuthorDate: 2026-07-21 13:03:24 +0000 Commit: Kristof Provost CommitDate: 2026-08-03 16:00:04 +0000 pf: fix securelevel off-by-one cmd_securelevel is the securelevel at which the call should be denied. pf (write) calls should be denied at level 3 or up (not at 2 or up as it was), so increment these all by one. PR: 296838 MFC after: 4 weeks Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D58377 --- sys/netpfil/pf/pf_nl.c | 94 +++++++++++++++++++++++++------------------------- 1 file changed, 47 insertions(+), 47 deletions(-) diff --git a/sys/netpfil/pf/pf_nl.c b/sys/netpfil/pf/pf_nl.c index 0e1c77864615..200f1dfca81a 100644 --- a/sys/netpfil/pf/pf_nl.c +++ b/sys/netpfil/pf/pf_nl.c @@ -2916,7 +2916,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_getstates, .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 3, + .cmd_securelevel = 4, }, { .cmd_num = PFNL_CMD_GETCREATORS, @@ -2924,7 +2924,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_getcreators, .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 3, + .cmd_securelevel = 4, }, { .cmd_num = PFNL_CMD_START, @@ -2932,7 +2932,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_start, .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 2, + .cmd_securelevel = 3, }, { .cmd_num = PFNL_CMD_STOP, @@ -2940,7 +2940,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_stop, .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 2, + .cmd_securelevel = 3, }, { .cmd_num = PFNL_CMD_ADDRULE, @@ -2948,7 +2948,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_addrule, .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 2, + .cmd_securelevel = 3, }, { .cmd_num = PFNL_CMD_GETRULES, @@ -2956,7 +2956,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_getrules, .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 3, + .cmd_securelevel = 4, }, { .cmd_num = PFNL_CMD_GETRULE, @@ -2964,7 +2964,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_getrule, .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 3, + .cmd_securelevel = 4, }, { .cmd_num = PFNL_CMD_CLRSTATES, @@ -2972,7 +2972,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_clear_states, .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 2, + .cmd_securelevel = 3, }, { .cmd_num = PFNL_CMD_KILLSTATES, @@ -2980,7 +2980,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_kill_states, .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 2, + .cmd_securelevel = 3, }, { .cmd_num = PFNL_CMD_SET_STATUSIF, @@ -2988,7 +2988,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_set_statusif, .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 2, + .cmd_securelevel = 3, }, { .cmd_num = PFNL_CMD_GET_STATUS, @@ -2996,7 +2996,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_get_status, .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 3, + .cmd_securelevel = 4, }, { .cmd_num = PFNL_CMD_CLEAR_STATUS, @@ -3004,7 +3004,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_clear_status, .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 2, + .cmd_securelevel = 3, }, { .cmd_num = PFNL_CMD_NATLOOK, @@ -3012,7 +3012,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_natlook, .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 3, + .cmd_securelevel = 4, }, { .cmd_num = PFNL_CMD_SET_DEBUG, @@ -3020,7 +3020,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_set_debug, .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 2, + .cmd_securelevel = 3, }, { .cmd_num = PFNL_CMD_SET_TIMEOUT, @@ -3028,7 +3028,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_set_timeout, .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 2, + .cmd_securelevel = 3, }, { .cmd_num = PFNL_CMD_GET_TIMEOUT, @@ -3036,7 +3036,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_get_timeout, .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 3, + .cmd_securelevel = 4, }, { .cmd_num = PFNL_CMD_SET_LIMIT, @@ -3044,7 +3044,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_set_limit, .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 2, + .cmd_securelevel = 3, }, { .cmd_num = PFNL_CMD_GET_LIMIT, @@ -3052,7 +3052,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_get_limit, .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 3, + .cmd_securelevel = 4, }, { .cmd_num = PFNL_CMD_BEGIN_ADDRS, @@ -3060,7 +3060,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_begin_addrs, .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 3, + .cmd_securelevel = 4, }, { .cmd_num = PFNL_CMD_ADD_ADDR, @@ -3068,7 +3068,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_add_addr, .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 3, + .cmd_securelevel = 4, }, { .cmd_num = PFNL_CMD_GET_ADDRS, @@ -3076,7 +3076,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_get_addrs, .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 3, + .cmd_securelevel = 4, }, { .cmd_num = PFNL_CMD_GET_ADDR, @@ -3084,7 +3084,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_get_addr, .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 3, + .cmd_securelevel = 4, }, { .cmd_num = PFNL_CMD_GET_RULESETS, @@ -3092,7 +3092,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_get_rulesets, .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 3, + .cmd_securelevel = 4, }, { .cmd_num = PFNL_CMD_GET_RULESET, @@ -3100,7 +3100,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_get_ruleset, .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 3, + .cmd_securelevel = 4, }, { .cmd_num = PFNL_CMD_GET_SRCNODES, @@ -3108,7 +3108,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_get_srcnodes, .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 3, + .cmd_securelevel = 4, }, { .cmd_num = PFNL_CMD_CLEAR_TABLES, @@ -3116,7 +3116,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_clear_tables, .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 2, + .cmd_securelevel = 3, }, { .cmd_num = PFNL_CMD_ADD_TABLE, @@ -3124,7 +3124,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_add_table, .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 2, + .cmd_securelevel = 3, }, { .cmd_num = PFNL_CMD_DEL_TABLE, @@ -3132,7 +3132,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_del_table, .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 2, + .cmd_securelevel = 3, }, { .cmd_num = PFNL_CMD_GET_TSTATS, @@ -3140,7 +3140,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_get_tstats, .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 3, + .cmd_securelevel = 4, }, { .cmd_num = PFNL_CMD_CLR_TSTATS, @@ -3148,7 +3148,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_clear_tstats, .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 3, + .cmd_securelevel = 4, }, { .cmd_num = PFNL_CMD_CLR_ADDRS, @@ -3156,7 +3156,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_clear_addrs, .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 3, + .cmd_securelevel = 4, }, { .cmd_num = PFNL_CMD_TABLE_ADD_ADDR, @@ -3164,7 +3164,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_table_add_addrs, .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 3, + .cmd_securelevel = 4, }, { .cmd_num = PFNL_CMD_TABLE_DEL_ADDR, @@ -3172,7 +3172,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_table_del_addrs, .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 3, + .cmd_securelevel = 4, }, { .cmd_num = PFNL_CMD_TABLE_SET_ADDR, @@ -3180,7 +3180,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_table_set_addrs, .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 3, + .cmd_securelevel = 4, }, { .cmd_num = PFNL_CMD_TABLE_GET_ADDR, @@ -3188,7 +3188,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_table_get_addrs, .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 3, + .cmd_securelevel = 4, }, { .cmd_num = PFNL_CMD_TABLE_GET_ASTATS, @@ -3196,7 +3196,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_table_get_astats, .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 3, + .cmd_securelevel = 4, }, { .cmd_num = PFNL_CMD_TABLE_CLEAR_ASTATS, @@ -3204,7 +3204,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_table_clear_astats, .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 3, + .cmd_securelevel = 4, }, { .cmd_num = PFNL_CMD_STATE_LIMITER_ADD, @@ -3212,7 +3212,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_state_limiter_add, .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 2, + .cmd_securelevel = 3, }, { .cmd_num = PFNL_CMD_STATE_LIMITER_GET, @@ -3220,7 +3220,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_state_limiter_get, .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 3, + .cmd_securelevel = 4, }, { .cmd_num = PFNL_CMD_STATE_LIMITER_NGET, @@ -3228,7 +3228,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_state_limiter_get, .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 3, + .cmd_securelevel = 4, }, { .cmd_num = PFNL_CMD_SOURCE_LIMITER_ADD, @@ -3236,7 +3236,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_source_limiter_add, .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 2, + .cmd_securelevel = 3, }, { .cmd_num = PFNL_CMD_SOURCE_LIMITER_GET, @@ -3244,7 +3244,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_source_limiter_get, .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 3, + .cmd_securelevel = 4, }, { .cmd_num = PFNL_CMD_SOURCE_LIMITER_NGET, @@ -3252,7 +3252,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_source_limiter_get, .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 3, + .cmd_securelevel = 4, }, { .cmd_num = PFNL_CMD_SOURCE_GET, @@ -3260,7 +3260,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_source_get, .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 3, + .cmd_securelevel = 4, }, { .cmd_num = PFNL_CMD_SOURCE_NGET, @@ -3268,7 +3268,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_source_get, .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 3, + .cmd_securelevel = 4, }, { .cmd_num = PFNL_CMD_SOURCE_CLEAR, @@ -3276,7 +3276,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_source_clear, .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 3, + .cmd_securelevel = 4, }, { .cmd_num = PFNL_CMD_TABLE_TEST_ADDRS, @@ -3284,7 +3284,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_table_test_addrs, .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 3, + .cmd_securelevel = 4, }, };