diff options
| author | Ed Maste <emaste@FreeBSD.org> | 2026-05-29 15:52:03 +0000 |
|---|---|---|
| committer | Ed Maste <emaste@FreeBSD.org> | 2026-05-29 23:11:21 +0000 |
| commit | 96dbc9a8de105065b6b1e55702aa648319176587 (patch) | |
| tree | 0df3984bf41beb15ee8e3097e2780afbfd1c97b2 | |
| parent | 9ddb6064f815ebdd0cfea4b2e0d3b6f0c98ea072 (diff) | |
netlink: Check permissions for interface flag changes
Reviewed by: pouria, melifaro
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D57332
| -rw-r--r-- | sys/netlink/route/iface_drivers.c | 11 |
1 files changed, 10 insertions, 1 deletions
diff --git a/sys/netlink/route/iface_drivers.c b/sys/netlink/route/iface_drivers.c index d26e92044ff5..79daa4215dba 100644 --- a/sys/netlink/route/iface_drivers.c +++ b/sys/netlink/route/iface_drivers.c @@ -83,6 +83,10 @@ _nl_modify_ifp_generic(struct ifnet *ifp, struct nl_parsed_link *lattrs, if ((lattrs->ifi_change & IFF_UP) != 0 || lattrs->ifi_change == 0) { /* Request to up or down the interface */ + if (!nlp_has_priv(npt->nlp, PRIV_NET_SETIFFLAGS)) { + nlmsg_report_err_msg(npt, "Not enough privileges to set flags"); + return (EPERM); + } if (lattrs->ifi_flags & IFF_UP) if_up(ifp); else @@ -104,7 +108,7 @@ _nl_modify_ifp_generic(struct ifnet *ifp, struct nl_parsed_link *lattrs, } if ((lattrs->ifi_change & IFF_PROMISC) != 0 || - lattrs->ifi_change == 0) + lattrs->ifi_change == 0) { /* * When asking for IFF_PROMISC, set permanent flag instead * (IFF_PPROMISC) as we have no way of doing promiscuity @@ -112,7 +116,12 @@ _nl_modify_ifp_generic(struct ifnet *ifp, struct nl_parsed_link *lattrs, * function either sets or unsets IFF_PROMISC, and ifi_change * is usually set to 0xFFFFFFFF. */ + if (!nlp_has_priv(npt->nlp, PRIV_NET_SETIFFLAGS)) { + nlmsg_report_err_msg(npt, "Not enough privileges to set promisc"); + return (EPERM); + } if_setppromisc(ifp, (lattrs->ifi_flags & IFF_PROMISC) != 0); + } if (lattrs->ifla_address != NULL) { if (!nlp_has_priv(npt->nlp, PRIV_NET_SETIFMAC)) { |