Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Anjali Kulkarni <anjali.k.kulkarni@oracle.com>
To:     Jakub Kicinski <kuba@kernel.org>
CC:     "davem@davemloft.net" <davem@davemloft.net>,
        "edumazet@google.com" <edumazet@google.com>,
        "pabeni@redhat.com" <pabeni@redhat.com>,
        "zbr@ioremap.net" <zbr@ioremap.net>,
        "brauner@kernel.org" <brauner@kernel.org>,
        "johannes@sipsolutions.net" <johannes@sipsolutions.net>,
        "ecree.xilinx@gmail.com" <ecree.xilinx@gmail.com>,
        "leon@kernel.org" <leon@kernel.org>,
        "keescook@chromium.org" <keescook@chromium.org>,
        "socketcan@hartkopp.net" <socketcan@hartkopp.net>,
        "petrm@nvidia.com" <petrm@nvidia.com>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        "netdev@vger.kernel.org" <netdev@vger.kernel.org>
Subject: Re: [PATCH v3 6/7] netlink: Add multicast group level permissions
Thread-Topic: [PATCH v3 6/7] netlink: Add multicast group level permissions
Thread-Index: AQHZYmvoV1sxO7snm0CxH2QmxW6asK8UckyAgACtcAA=
Date:   Fri, 31 Mar 2023 17:00:27 +0000
Message-ID: <830EC978-8B94-42D6-B70F-782724CEC82D@oracle.com>
References: <20230329182543.1161480-1-anjali.k.kulkarni@oracle.com>
 <20230329182543.1161480-7-anjali.k.kulkarni@oracle.com>
 <20230330233941.70c98715@kernel.org>
In-Reply-To: <20230330233941.70c98715@kernel.org>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?nHCspz4O836pc0QtXFEXGmbiR/0R3/NMJ1MNNo51wF4zJyaXX+H2BGw6J0u1?=
 =?us-ascii?Q?g//6CeFbcFk2F2r4KMYy9p5yr2QQNgTmrzHGj3DqgxkYWyrTxNZuBBbIEvqy?=
 =?us-ascii?Q?v1Ry56VHVGdGQ0/ihdGChtjkAbBwQ17TgUkfw8XgroAL5YR+3eCFKATkjDIg?=
 =?us-ascii?Q?W/6cK3HKbIVClZ5sWUkAzO3B61j+CYUPUq/uY6JCYgp5lYv6uzQPbcx2yMNF?=
 =?us-ascii?Q?TsGeEw88YIxfI0o1uYZoRCjcSIhmBeoBcsEuDNH31uyhvqqzCs7PzCfkcoEo?=
 =?us-ascii?Q?2NWo3qciBBCUflEHUnBCwSBzHeyb51rsqmJJnnI2HhWqoA2574cNYLYtLTJt?=
 =?us-ascii?Q?9q4weMXa6fJOTDbtAep1E2HtvQcewJQHZWMhXkxSs1leS+vC3Oa4hH8gGGVh?=
 =?us-ascii?Q?5fgNTE3nuFIgLbRCdldcZglmoeQ5k5SBxLldVkOT5NEoHFSBIMWTFfF92txC?=
 =?us-ascii?Q?qkxf9nTxWYillLpf6bMxdMCGWZgrqLZIlolZK/d9+buw0j5z+bwSOI7Pcbjm?=
 =?us-ascii?Q?Flj7T9dzf960j0VFiybInkIGOodorTWmqkF09fdZKxX2ryzBL9K+Ed2syclH?=
 =?us-ascii?Q?MxQ9T5Ot0mUeHDyC3me4HPqIqWhIijJ34DpRI5APfiE5Vun8oEMF28Y5+ELq?=
 =?us-ascii?Q?XWUAmjivru5y3DXg0lz8Oz8eftsi9XA1zLhwsLsNvVwYcFAM5yUtWDlPTUG8?=
 =?us-ascii?Q?gEfzSUYq4zC8GPKzVzw8S37l+qLLiAO5yTo22n6oxhPeRlx66zLDA0OmQbzb?=
 =?us-ascii?Q?HkqLjAnF7pMfCRnQygO6f7mGalK4Q8OKtfhsIOh9a0N87y7Wd5J5efVTKPU3?=
 =?us-ascii?Q?rwl4vFGDhstBVdVUGBkxwXacYc4iOI/mEScNKTvBfHGIOmJUeATfdee3lWBv?=
 =?us-ascii?Q?dr9m8OZsZyQCkMuZkbjVRr3Y1XYluEKq58ymMB/I69j+lmdTOsDpDruy7GIf?=
 =?us-ascii?Q?aeZ27uhk/rqgAQXfSsjx7pKul++oxo9FhvROJtCRI54YOWTF11VvnCGl0xH+?=
 =?us-ascii?Q?GR+1Th+DdgGSKZv4vLkYIH1opOIxI1O25/AOHi9qzaKZgZ3ND+tCQmuJpG87?=
 =?us-ascii?Q?FDMHfAS+TVZdvNstvc2OIpyHZOAQgLcFW4gsRZKEmWYE3A+7j1+xHuJMHUEf?=
 =?us-ascii?Q?IWWQ5as6C+/cd7DowvXqPQLp9w0PZgMtE18YvuRsqqM7YgqQsnnLqilpAv5B?=
 =?us-ascii?Q?SK1oGFrhB84ajL3bfuP3yaxsdzzS8tM3wq8p6+TaKyTGl1oz8bz8RPvi1Ikp?=
 =?us-ascii?Q?akcZpr6KsWy0UOk1madOzi6jTGuqLbgrrU8nRZh8A0i2x33PFrrYPRXI7Hsn?=
 =?us-ascii?Q?Neey4Em5TAyVC+WaTdMwySs0sDVhhpIxqILSXe0CkswJZ8mgQASIs243Bfxh?=
 =?us-ascii?Q?76H9MfmuSKX/Zvy/3BJ804DZ9cozLdmcVcltn4MS9602nnVKwDCSvhylRM5P?=
 =?us-ascii?Q?mnstBtAGfVSvbw/wlGPGcRKNaEcDpkBq+9eq7B+7s4JKIFPrmxduMwJkqWPV?=
 =?us-ascii?Q?N+OKpLyuM4iImX+99cwQjgdFNnwDO3wST/k3HRt7/OlLfofJkksoxXA14CDf?=
 =?us-ascii?Q?xeRhJQUCY9y9adoPXjROYnaep7K9bScGA6/30dg7osMQfdrA/GbTTPFX5ke0?=
 =?us-ascii?Q?jntOeOqwoB62vYSibW3peWu331WM82Q5mH/ZXODpyd3q?=
Content-Type: text/plain; charset="us-ascii"
Content-ID: <E8E0DCBC308B8C4FB39AB7F2BA45759F@namprd10.prod.outlook.com>
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-0: =?us-ascii?Q?Z3TNmWvQVV0Pq8+eU7owZQAssa8pLK5NRhSfl2JxEMzVGHlDmgqQNeOhrjQH?=
 =?us-ascii?Q?EaMyVjYiKVeBYEIMeJGKZBeGZzUSoZxSTSh9dIwlKhVMab5Ml8hanSJ/Z0v0?=
 =?us-ascii?Q?h29/qT0uzJ33QJCi7y/LHG7d6nlWDKKXqSiAWFb7JmhiEppKyEE/7NH71NCQ?=
 =?us-ascii?Q?RiUfhG5ykshqQmCZ9cITCSMx7kW3D0Oo4GO5MVHSM/iIZIOnt9DNZtt7CF5U?=
 =?us-ascii?Q?pldgID5YTQSJYjSr09pfVOB5HknWjQrMYAgxiLthhjGWzIHqj8UetOSunmbD?=
 =?us-ascii?Q?kZ7hajtT9jAy/UIiv6JZYGksCokXiqdwzzcGPxcptsEWZoP9qcapH8j8exN/?=
 =?us-ascii?Q?lKJX7L1piY7O+HFyjct+SlcE20Pn1p81iU5mUOIVAQfQ+yVBednuAZMIbCJZ?=
 =?us-ascii?Q?6CmjrwPMi7He25MAIYdB8zHA/nsQQC66cxBgVR5s3rn0wzo4YKz+0Rqto/VQ?=
 =?us-ascii?Q?6hU2gSgIpwHxoQxLSzkbPg/fXn9jZ+ARqjiclfyXTUOdh6P+kt4EHOaqKc84?=
 =?us-ascii?Q?TctOesatWmXmoMTGGtzR9Cpbvyhi8YtfdWYqfKO826l9ZpkLj8fyUbholYFm?=
 =?us-ascii?Q?d9OD1qs20iWJOfK4rRPGSKLPuTY34wlqk0u32v3pMymzVi902owejrJt9y1A?=
 =?us-ascii?Q?vVeQNkBR5Iu7RYv4iPz4Tan7V3AsNzJyKnadMOj53jjuw+L8HuuVIo/B1e45?=
 =?us-ascii?Q?bvemEytJvlE55BQjZNs/0EMPGtN7QqIpuckY1uZ34o7FHaZ9e0kiIF68FE5l?=
 =?us-ascii?Q?brXxrav075zLuVlTmBzFl5qx/x5AKgGo+/lgVR7bUjvOuFhaVLCl5pGR74Vb?=
 =?us-ascii?Q?X9bLgUp/APA034fB2/iXgiHpvhs+NTwu0hEUgcNchMefM4KnsV7Yu7yQ0XlM?=
 =?us-ascii?Q?aSa4/V+X/5kZ86Xck1b/s7/LmlWjX6/gjoitK/1b7kyM6eMH/gpDgqxg3n73?=
 =?us-ascii?Q?pxFjs6f9lHEvQvj4jCf+PEAAkgUHSfDtoh/SWc0LkkAJMx0k2lQNXsQI6woQ?=
 =?us-ascii?Q?vYuB7wge1tCoG8G3DucShZ3qAgT2zMXaSkSy2wCbcSnvwmoqVE+A9rtofbj7?=
 =?us-ascii?Q?+1EumZRn9/zpTpF8XrmKAbGDrcCEWA=3D=3D?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: BY5PR10MB4129.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: cffcdefa-b989-4b6b-cfa5-08db32096d85
X-MS-Exchange-CrossTenant-originalarrivaltime: 31 Mar 2023 17:00:27.6407
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: Nyi1lxdyut/sa1Il/WbHPhRQTOcCtVwJ44RV7y48kKPEHPqPkrZMU5JG79Qgva9ViCi5+oXudlFwiNTYo/Yb4ri+c5/iRs6aeN8RzigyhKc=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH0PR10MB5643
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.254,Aquarius:18.0.942,Hydra:6.0.573,FMLib:17.11.170.22
 definitions=2023-03-31_07,2023-03-31_01,2023-02-09_01
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 adultscore=0 bulkscore=0 spamscore=0
 phishscore=0 mlxscore=0 mlxlogscore=924 suspectscore=0 malwarescore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2303200000
 definitions=main-2303310136
X-Proofpoint-GUID: cPi_Zkv0W0Iz5Cmn7FUvZK5L-orpqWhO
X-Proofpoint-ORIG-GUID: cPi_Zkv0W0Iz5Cmn7FUvZK5L-orpqWhO
X-Spam-Status: No, score=-0.9 required=5.0 tests=DKIM_SIGNED,DKIM_VALID,
        DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,RCVD_IN_MSPIKE_H2,
        SPF_HELO_NONE,SPF_NONE autolearn=unavailable autolearn_force=no
        version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org


> On Mar 30, 2023, at 11:39 PM, Jakub Kicinski <kuba@kernel.org> wrote:
>=20
> On Wed, 29 Mar 2023 11:25:42 -0700 Anjali Kulkarni wrote:
>> A new field perm_groups is added in netlink_sock to store the protocol's
>> multicast group access permissions. This is to allow for a more fine
>> grained access control than just at the protocol level. These
>> permissions can be supplied by the protocol via the netlink_kernel_cfg.
>> A new function netlink_multicast_allowed() is added, which checks if
>> the protocol's multicast group has non-root access before allowing bind.
>=20
> Is there a reason this is better than implementing .bind
> in the connector family and filtering there?

Are you suggesting adding something like a new struct proto_ops for the con=
nector family? I have not looked into that, though that would seem like a l=
ot of work, and also I have not seen any infra structure to call into proto=
col specific bind from netlink bind?