• Linus Lüssing's avatar
    batman-adv: allow netlink usage in unprivileged containers · 9057d6c2
    Linus Lüssing authored
    Currently, creating a batman-adv interface in an unprivileged LXD
    container and attaching secondary interfaces to it with "ip" or "batctl"
    works fine. However all batctl debug and configuration commands
    fail:
    
      root@container:~# batctl originators
      Error received: Operation not permitted
      root@container:~# batctl orig_interval
      1000
      root@container:~# batctl orig_interval 2000
      root@container:~# batctl orig_interval
      1000
    
    To fix this change the generic netlink permissions from GENL_ADMIN_PERM
    to GENL_UNS_ADMIN_PERM. This way a batman-adv interface is fully
    maintainable as root from within a user namespace, from an unprivileged
    container.
    
    All except one batman-adv netlink setting are per interface and do not
    leak information or change settings from the host system and are
    therefore save to retrieve or modify as root from within an unprivileged
    container.
    
    "batctl routing_algo" / BATADV_CMD_GET_ROUTING_ALGOS is the only
    exception: It provides the batman-adv kernel module wide default routing
    algorithm. However it is read-only from netlink and an unprivileged
    container is still not allowed to modify
    /sys/module/batman_adv/parameters/routing_algo. Instead it is advised to
    use the newly introduced "batctl if create routing_algo RA_NAME" /
    IFLA_BATADV_ALGO_NAME to set the routing algorithm on interface
    creation, which already works fine in an unprivileged container.
    
    Cc: Tycho Andersen <tycho@tycho.pizza>
    Signed-off-by: default avatarLinus Lüssing <linus.luessing@c0d3.blue>
    Signed-off-by: default avatarSven Eckelmann <sven@narfation.org>
    Signed-off-by: default avatarSimon Wunderlich <sw@simonwunderlich.de>
    9057d6c2
netlink.c 41.2 KB