Skip to contentSkip to conversation

net: psp: require admin permission for dev-set and key-rotate

PATCH Applied Jakub Kicinski 4 participants 4 messages Apr 27 – Apr 29

Subsystems (4)
Networking Network drivers YAML netlink (YNL) Psp security protocol
lore
Share & tools
lore

Jakub Kicinski

author maintainer
#0 lore raw

PATCH 1/1 net: psp: require admin permission for dev-set and key-rotate

The dev-set and key-rotate netlink operations modify shared device state (PSP version configuration and cryptographic key material, respectively) but do not require CAP_NET_ADMIN. The only access control is psp_dev_check_access() which merely verifies netns membership.

Fixes 00c94ca2b99e ("psp: base PSP device support")
Signed-off-by Jakub Kicinski <[email protected]>

---
CC: [email protected]
CC: [email protected]
CC: [email protected]

---
 Documentation/netlink/specs/psp.yaml | 2 ++
 net/psp/psp-nl-gen.c                 | 4 ++--
 2 files changed, 4 insertions(+), 2 deletions(-)
Documentation/netlink/specs/psp.yaml +2 -0
index 100c36cda8e5..bfcd6e4ecb85 100644
@@ -188,6 +188,7 @@ name: psp
       name: dev-set
       doc: Set the configuration of a PSP device.
       attribute-set: dev
+      flags: [admin-perm]
       do:
         request:
           attributes:

@@ -207,6 +208,7 @@ name: psp
       name: key-rotate
       doc: Rotate the device key.
       attribute-set: dev
+      flags: [admin-perm]
       do:
         request:
           attributes:
net/psp/psp-nl-gen.c +2 -2
index 22a48d0fa378..953309952cef 100644
@@ -76,7 +76,7 @@ static const struct genl_split_ops psp_nl_ops[] = {
 		.post_doit	= psp_device_unlock,
 		.policy		= psp_dev_set_nl_policy,
 		.maxattr	= PSP_A_DEV_PSP_VERSIONS_ENA,
-		.flags		= GENL_CMD_CAP_DO,
+		.flags		= GENL_ADMIN_PERM | GENL_CMD_CAP_DO,
 	},
 	{
 		.cmd		= PSP_CMD_KEY_ROTATE,

@@ -85,7 +85,7 @@ static const struct genl_split_ops psp_nl_ops[] = {
 		.post_doit	= psp_device_unlock,
 		.policy		= psp_key_rotate_nl_policy,
 		.maxattr	= PSP_A_DEV_ID,
-		.flags		= GENL_CMD_CAP_DO,
+		.flags		= GENL_ADMIN_PERM | GENL_CMD_CAP_DO,
 	},
 	{
 		.cmd		= PSP_CMD_RX_ASSOC,
Signature · 1 line
2.53.0
maintainer Reviewed-by on v1 1/1
#1 lore raw
Quoted 8 lines · Jakub Kicinski

The dev-set and key-rotate netlink operations modify shared device state (PSP version configuration and cryptographic key material, respectively) but do not require CAP_NET_ADMIN. The only access control is psp_dev_check_access() which merely verifies netns membership.

Fixes 00c94ca2b99e ("psp: base PSP device support")
Signed-off-by Jakub Kicinski <[email protected]>
Reviewed-by Daniel Zahka <[email protected]>
maintainer Reviewed-by on v1 1/1
#2 lore raw
In reply to Jakub Kicinski
Quoted 8 lines · Jakub Kicinski

The dev-set and key-rotate netlink operations modify shared device state (PSP version configuration and cryptographic key material, respectively) but do not require CAP_NET_ADMIN. The only access control is psp_dev_check_access() which merely verifies netns membership.

Fixes 00c94ca2b99e ("psp: base PSP device support")
Signed-off-by Jakub Kicinski <[email protected]>
Reviewed-by Willem de Bruijn <[email protected]>
CI Applied
#3 lore raw
In reply to Jakub Kicinski
This patch was applied to netdev/net.git (main) by Jakub Kicinski <[email protected]>:

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <[email protected]>:

Quoted 10 lines · On Mon, 27 Apr 2026 12:58:56 -0700 you wrote:

The dev-set and key-rotate netlink operations modify shared device state (PSP version configuration and cryptographic key material, respectively) but do not require CAP_NET_ADMIN. The only access control is psp_dev_check_access() which merely verifies netns membership.

Fixes 00c94ca2b99e ("psp: base PSP device support")
Signed-off-by Jakub Kicinski <[email protected]>

[...]

Here is the summary with links:
- [net] net: psp: require admin permission for dev-set and key-rotate

    https://git.kernel.org/netdev/net/c/b718342a7fba

You are awesome, thank you!

Signature · 2 lines
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html