Received-SPF: pass (google.com: domain of linux-kernel+bounces-96202-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.48.161 as permitted sender) client-ip=147.75.48.161;
IronPort-PHdr: A9a23:U8kbOxw2aKrhQsjXCzKOy1BlVkEcU8jcIFtMudIu3qhVe+G4/524Y
 RKMrf44llLNVJXW57Vehu7fo63sCgliqZrUvmoLbZpMUBEIk4MRmQkhC9SCEkr1MLjhaClpV
 N8XT1Jh8nqnNlIPXcjkbkDUonq84CRXHRP6NAFvIf/yFJKXhMOyhIXQs52GTR9PgWiRaK9/f
 i6rpwfcvdVEpIZ5Ma8+x17ojiljfOJKyGV0YG6Chxuuw+aV0dtd/j5LuvUnpf4FdJ6/UrQzT
 bVeAzljCG0z6MDxnDXoTQaE5Sh5MC0ckk9QDwvu1x3rRbTzqC3G9dtyggWfM9fpROh3f2qTy
 qNKSjbGigUXOh1pyE+H358V7upR9SD/lUZAmLSKObGJF+NTI5HPJsgaZ0VdQcRAR3RsGoW9Q
 4QRPdZeB7h4hrjzuXw1qAu3FxKnGOXB7h1Cj0LK4ag7y8IoEyzDw0smAOsjkHSEoY2tNakca
 dLl16eVkmjFP9RY9XDdy6PZQDpmgK6BdJkhe+PhkEUyTRqGjW2VpKnZH2PM3N0GvVS0zbU4b
 O+w0FI9txp1mCCV3MV3torb354lx07UzwF7n4oHLojrAF4+YMSjFoNXrT3fLYZtX8c+Fnlho
 z1polVnkZuyfSxPxZgoyjT+MaTbNYaS6w/lVOGfLC0+iH82ML68hhPn6UG70aW8Tci71l9Ws
 zBI2sfBrHED1hHfq4CHR/Jx813n2GOn2Rra9+dEJk45j+zcLZsgyaQ3jZ0drQLIGSqepQ==
IronPort-SDR: 65ea24a2_cqVRLBWxykHTxzqr/3CB6wcsDM2pIPkWLC12AYLa16XvZiE
 VBSo4R8mRrvvduc3vWb7okkoA1hgb8pwmZYRw5w==
IronPort-PHdr: A9a23:ciLomhZp/kPMAjUqvsmoLiz/LTFg0YqcDmcuAucPlecXIeyqqo75N
 QnE5fw30QGaFY6O8f9Agvrbv+f6VGgJ8ZuN4xVgOJAZWQUMlMMWmAItGoiCD0j6J+TtdCs0A
 IJJU1o2t2ruKkVRFc3iYEeI53Oo5CMUGhLxOBAwIeLwG4XIiN+w2fz38JrWMGAqzDroT6l1K
 UeapBnc5PILi4lvIbpj7xbSuXJHdqF36TFDIlSPkhDgo/uh5JMx1gV1lrcf+tRbUKL8LZR9a
 IcdISQtM2kz68CujhTFQQaVz1c3UmgdkUktYUDP7ETiUpTaiSfrrcl/wi+mfvz5F5wxVy695
 v8obkHZrSMmNRcX8kPHh+8gtIwL9UHExVR1lryKUtuqb8AgJ5PBXso3GFhTBd1RdQNdHYGtf
 9MiF+wAEelGnbWinQUuhCqwGy6XAfPm2CRDmnnY+Y8w2tkdLQTHxCopHf8LrzPSs+zYFKdCX
 LjtzafG9QeTdP0Lhmr7uK/GXlcBgtqdb5g3UJXc4GJ+HSr111mN85WmPAuQ28ExkzjC5dNrW
 96AqTF/kgxu+QS12twosJHznIBO9lPWrDlJzZglH/m6F0JJaov3WIsVtjudMZNxWN9nWWxzp
 SImn6UPooXoFMBr4JEuxhqabuCOUKHSslTtTu+MJzd/in9/Pr6y1F6+8kmln/X1TdL8kE1Lo
 SxMjsTWuzgT2gbS5MmKRro1/kqo1TuVkQGGwu9eKF0yla3VJoRnxbg1l5EJtl/EEDOwk0Lz5
 JI=
IronPort-Data: A9a23:GAxFNKOdM0JEroHvrR3Hk8FynXyQoLVcMsEvi/4bfWQNrUp01TMCn
 GYdDWCCParbMDb0Kd0kbY20/EoFusLVmtM3HXM5pCpnJ55oRWUpJjg5wmPYZX76whjrFRo/h
 ykmQoCdaphyFjmF/kvF3oHJ9RFUzbuPSqf3FNnKMyVwQR4MYCo6gHqPocZg6mJTqYb/W1zlV
 e/a+ZWFZAf+g2EsbAr41orawP9RlKSq0N8nlgFmDRx7lAe2v2UYCpsZOZawIxPQKmWDNrfnL
 wpr5OjRElLxp3/BOPv8+lrIWhFirorpAOS7oiE+t55OIvR1jndaPq4TbJLwYKrM4tmDt4gZJ
 N5l7fRcReq1V0HBsLx1bvVWL81xFfVj2ODWCnThivCCzQ7dUnLIzMdOE05jaOX0+s4vaY1P3
 ecdNChLYwCIh6S42rumTOlriMk5asXmVG8dkig9lneIUrB/HsGFGv+VjTNb9G9YasRmGPfVZ
 8MUbXxwYRXbeDVGO0waA9Qwhu61gHn4fTBC7l6YzUYyyziDklAuieKF3Nz9XdmQdZkEnkCj5
 UHG30KkXzMECMK0xm/Qmp6rrqqV9c/hY6oSE6e97dZ0jUecyyoVBQFQXEbTifuwolWlWpRVJ
 CQ84iMkqa8a8kG3QNj5QxCi5nmesXY0WNNcF+AxwAeA1qTV5xqUHC4DVDEpQNI5nNQqXzgn0
 BmFkrvBCTVxvbi9RXuD+7KQqj2ufy4YMQcqaCMZSAIX7sXLr4Y0gRbCCN1kFcadjcD/EBnzz
 iqMoSx4gK8c5eYT3q+2+1HvmT+gppHVCAUy423/WG+54g5nTJCqapbu6lXB6/tEaoGDQTGpu
 GYf3sST8u0KJY+CmTbLQ+gXGrytofGfP1X0h1NzEZgl6zm3vnKuY41UyC9xKV0vMcsefzLtJ
 kjJtmt575hJMWenZKpfZY+tBcUu0aX6U9P/WZj8attIf4g0dwKd+ixqTVCf0nqrk0U2l6w7f
 5CBfq6R4W0yUPk8iWvpAr5CgPpynH9422aVTtb11R2617qZanOPD7sIWLeTUt0EAGq/iFy92
 /5RLcKXzRVYXuDkJC7R9I8YN1cRKnYnQ5vxrqRqmiSre2KKwUlwWqOD8qBrYIF/gaVem8HB+
 3z3CAcSy0PyiTeDYU+GY2xqIuGnF5tuj2MJDQp1N3aR2l8nfdmO6oUbfMAJZrUJzrFo4sN1a
 PgnQP++JMpzZA7JwQlAUqmlnrdeLEyqoSmsIxuaZCMOes88Zg7Rpf7hUAjd1AgPKSuVtcIOh
 bmRx17eSp8tHg5nDNjkbcy+61aLuVkch+NAcE/aKfZDeEjX0dZLKg6gqtQVMs0zORH46T/C7
 DmvADAcvvjrn4851PLrlJK0hd6lPMUmF3ULAlSBy6i9MBfr21aKwKhCYb6uRi/cXmalw5eST
 7xZ4N+kOcJWgWsQlZR3Fotq6qcM59HPgbt+5SY8FVXpa2WbMJ9REkOk7+Ju6JIUnqR4vDGoU
 H2h4tNZYLWFGP30GW4reTYKUL6x6uE2qBLzs9IOP0TI1A1m9uGmUGJTHSW2pg5zEb9XCL4hk
 MAd4JM4ygrnkRc7EMe0vgYN/US2E3EweaEGtJYbPYzVtjQW2mxyOZzxNyunz6yMOvNtM1YrK
 AC6nKDtpapR7WucfmsRFUri5/t8h5MPiS9O3m09Akm7nPjFisBq2xcLwzA8T1lW/C5myMN2A
 HBgbGduFJWN/hBppclNZH+tEAd/Hy+k+lT95l8KtW/BRWyqazD9F3I8MuOz40wpyWJQUTxF9
 rW+ymy+czLVUOzu/yk1A2hJlufCSIFvywj8h8yXJcSJMJ0kaz7DgKX1R24pqQPiMPwhln/8u
 uhm0+ZhW5LVbRdKjfUANLCb8rAMRDSvBm9IG6hh9ZxUO1DsQmi53DzWJn2hfs9IGefxzna5L
 M5TPeNKaQW10XefjzIcBJNUGYROotwS2IMgdI/odEk8iJnOihpysZnVyDryu39zffVqjvQGC
 93wcxCsLzWuoEV6yk73kdl8G2unYNM7ShX288Kr/c4oSZ8SkuFeXnsj87mzvn7PaVNs1E+Qs
 SzlYIvT/f1T+bpxlqS9F5dzJhiGBu7ycM+q8wmDlctEQv2SEMXJtiIT8kLGOSYPN5Qvet1Hr
 5a/m/+p41Hk5ZEYC3v4nbuFHIl3vfSCZvJdaJ/LHSMLjBm8V9/JyDpd3WKBcLhiss5Xv+ujT
 CuGMPqAT8YfAYph9ScEehplMkgvDorsZf3dvgK7lfOHDyYd3SHhLN+K8XzIb3lRRhQXOq/RW
 xPFhPKz2u929Ih8JgcIJ/VDMa9KJFXOXagHddqokRK6CmKuoE2Ju5q8tB4GxAzINEK5E5fB0
 cqYfiT9SRW8hviZhpUR+Yl/pQYeA3tBkPE9NBBVscJ/jzehSnUKN6IBOJEBEYtZiTH2yIq+X
 jzWcW8+Em/oaFyoq/knDAjLBW9z3tAzB+o=
IronPort-HdrOrdr: A9a23:ZbYRV6hmz2WVHXl9LAThOXBXyHBQXyx13DAbv31ZSRFFG/FwyP
 rAoB1L73PJYWgqNU3I+ergBEGBKUmskaKdhrNhR4tKPTOWw1dASbsN0WKM+UyHJ8STzJ8+6U
 4CSdkANDSPNykCsS+S2mDReLxBsbq6GciT9JvjJhxWPGZXgs9bnmJE4lHxKDwKeOAKP+tOKH
 LajfA31AaISDAyVICWF3MFV+/Mq5nik4/nWwcPA1oC5BOVhT2lxbbmG1zAty1uGw9n8PMHyy
 zoggb57qKsv7WSzQLd7Xba69BzlMH6wtVOKcSQgow+KynqiCyveIN9Mofy9QwdkaWK0hIHgd
 PMqxAvM4Ba7G7QRHi8pV/X1wzpwF8Vmgrf4G7dpUGmjd3yRTo8BcYEr5leaAHl500pu8w5+L
 5X3kqC3qAnQC/orWDY3ZzlRhtqnk27rT4JiugIlUFSVoMYdft4sZEfxkVIC50NdRiKorzPKN
 MeQ/002cwmP29zNxvizyhSKZ2XLz8O9y69MwQ/Upf/6UkXoJh7p3FotvD30E1wt67VcKM0l9
 gsAp4Y6o2mcfVmHJ6VfN1xOfdfKla9NS4kY1jiVmgPUpt3eU7wlw==
From: =?UTF-8?q?Michael=20Wei=C3=9F?= <michael.weiss@aisec.fraunhofer.de>
To: Simon Horman <horms@verge.net.au>, Julian Anastasov <ja@ssi.bg>
CC: <gyroidos@aisec.fraunhofer.de>, =?UTF-8?q?Michael=20Wei=C3=9F?=
	<michael.weiss@aisec.fraunhofer.de>, Pablo Neira Ayuso <pablo@netfilter.org>,
	Jozsef Kadlecsik <kadlec@netfilter.org>, Florian Westphal <fw@strlen.de>,
	"David S. Miller" <davem@davemloft.net>, Eric Dumazet <edumazet@google.com>,
	Jakub Kicinski <kuba@kernel.org>, Paolo Abeni <pabeni@redhat.com>,
	<netdev@vger.kernel.org>, <lvs-devel@vger.kernel.org>,
	<netfilter-devel@vger.kernel.org>, <coreteam@netfilter.org>,
	<linux-kernel@vger.kernel.org>
Subject: [PATCH] ipvs: allow netlink configuration from non-initial user namespace
Date: Thu,  7 Mar 2024 21:31:06 +0100
Message-Id: <20240307203107.63815-1-michael.weiss@aisec.fraunhofer.de>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Precedence: bulk
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?SlFTanIrRHlUd0pleHFsa1JaZ0RqMklzMmtBNFN4U0tOQk01djFZRG9tQWFQ?=
 =?utf-8?B?UDJFQVVhRFpmNFRvQ2V6ZFZZbXRVbGo3SnFDcTRLOXU3dTFiWHc4RUoxN2JM?=
 =?utf-8?B?U0VYNjltSG9SbzFxQXNaeTVaaXhuZU5wa3JPN3J6MUNpT2ZrZW1PbVptcDFk?=
 =?utf-8?B?elJSMC9XS3JpOW0zQmtOYmZ4MVovWTJKbnhySGNCUXZlVGVSMzQzQldaV1Q2?=
 =?utf-8?B?Wmtidit5N3IrUzYva3ZzOTJaZjlqSmllbTl1V1FuZGtuM0hFL2VJWUpiU2dT?=
 =?utf-8?B?WERsMWlKL0FQcVNSeDF3NFYraUd0SkN5MHNNbU5mYzMxb2UwdkQ0YnFDQ3U5?=
 =?utf-8?B?RHl6Wmg5d1czY2ZpaFBpUmErTzhCRlFBdnA1bkZ4WUZodEIwcVVwYURVODUy?=
 =?utf-8?B?NmR4TE9odTkzUEJaaklmMXB1d2I4Zm9acDJYdDFrQUpRRnBMUXg3QnVSV2li?=
 =?utf-8?B?SlMxempxN3Q3a3B2cDBOdjBkMHZLQzd3MHBnUVhiV3FTVHdNRXZrWTJjM0V3?=
 =?utf-8?B?Y0pQczd6WWdkN3g1Qm1aclZjUHcyRFZFZWZEdzNYRXA0T2M3bUFBTkI2K1Nn?=
 =?utf-8?B?N0dMSFE4MHJNWUo1VUEwVjE1emFlSkdxVDdNUVNtc3JINTBuaEZFdWoxMkE1?=
 =?utf-8?B?UjJ0U2xYcm05dlRLNTBrQjBGb2NBcXRKWkRyTktKYTdLbUJMOWRyaXRqTlhw?=
 =?utf-8?B?OTM0dmpmakdpc2J0WmdaVVd2TGF6aTlTbU1PcTB5Ky9NSnZtbGI2OVJjbVpW?=
 =?utf-8?B?S0VIdXNKb0oweUNnVTltWE5YOFREZE5UQUlhTVlmbVRmamRybkVYYTByZFh3?=
 =?utf-8?B?aWYvR202aVpzZUZjL0hzKy9pS2JnRWZjVGY2TkVFNHZGUzdGSEpwZWFpTFBE?=
 =?utf-8?B?Yi8wd0xXZjVGby9rMzRYQ0YyMjBtS1ZqVVJVVDVEeVRlTkloblBUMWJrVldR?=
 =?utf-8?B?WGdiVFpCQTl1TDI0UDN1M2RQWFVtYm5sTVYydXh5dURSRk5PUS9DQW1PRElF?=
 =?utf-8?B?WjFYcjJGaytyeHF3MWVLUWFCOUNRM3FPZHZTNjZTSWJJUFBEa1A3U1orcncr?=
 =?utf-8?B?bXJPUEJhT2xkUzhXRTcrTkdJOHc5TlhIcDB6dlkvNEcvRmZzd2pQWjNCd0hq?=
 =?utf-8?B?dVJlRWZiUGV1VVRoZDNqeGNteDhMRTRRZ2s2TjJmQTlvaWVVQlNaY0daNGdF?=
 =?utf-8?B?M2xoWHN5WUdTQVhwTXZVNTd1M2FhelpQcm8rVVVDUXZpUlhkTzlrYTZXYkdz?=
 =?utf-8?B?d0QwaDNUbmIrM1ZIM2lwR0Y3ekhwSHpwdnJtRDdsaDJQeDBvY2o3endaOEFH?=
 =?utf-8?B?Z1B3NFhTejRhak5xTUNPQk84OXJQcHNCbVk3YWZMTHpGdzIzTXVzUEVER25i?=
 =?utf-8?B?cWxVbFFEcU9wYWJiSjVMTnhsbU03USs0aW1WRFJIVi84a3c4Z0R5TnV2ajZW?=
 =?utf-8?B?ckp0TEJhSWh1bHZZeEJGajFqbkpDTUFsdnR3MEk4MExyc2N4UmdWa0tkWm5I?=
 =?utf-8?B?OHNQTnhZTXVSZTlPRWhFTTZSL0lNSjl1VGVlclJIK0h6NVNSYzBtZDl4Vm9R?=
 =?utf-8?B?dThGejc3U29HZ0NveitFTmk3ZkN4cHVZV2tLMzF0Z25EWnNESTAyajMvWjZu?=
 =?utf-8?B?dzhxN1ZyZERHVGZDZ3lETnpKdi9aSWt6ZTYxMWF0NGVnNk41eGpNYnNBZ1JE?=
 =?utf-8?B?OUViYzcyUUliNVd6Nmd3UzlqRkJKZm5IWFFZa2ZGNFdMTzhlKzRqTjh5TmR6?=
 =?utf-8?B?eE5KUDdybEtZVTVtSFJKV3puR1hVeXJHNFNjQ1E2ZGRRL0o1OTd5bW9PSHJP?=
 =?utf-8?B?cFhoZmMybTU5bjVhSWtqMXVLdHoyMTAwTHdnQk9tQWRUeThJLzhjbXR4TG1j?=
 =?utf-8?B?TE9qYWVWUVBlVXM4bkVjQVRsK01uZlRyUityczEvbXZ3WFF5TldXaG5oZXY1?=
 =?utf-8?B?bjJJNVpDd0x2ZFdiU2c1OXY5UkE1L3VUQmUyMWx2MnVJVnQyR0lvS3lEczZO?=
 =?utf-8?B?akdPNGRLNG1rWURCVEZ6RGJIZFBJUnZUVmF3MnZCS3JoMWtyVlBKc01kcXht?=
 =?utf-8?B?RnRCbE81MVc5MXZOR3JyVllSeXZvdlFVNkxIQXBkTlY1YmtVa0JWN0dUZHlK?=
 =?utf-8?B?NmNKOTN2UFNmYUFWUGJEWlNyeC9VV3lXM3AzdWhCMG5Gc25sdGZWVHYrNkJP?=
 =?utf-8?B?U2lRNjNuUXVlVmEzUjEwMEFrNVhTdFpJSDFNSkw1ZXBad2xNYVFaYlQ2bHRi?=
 =?utf-8?Q?+/bb4Y1Ob7cQr90omv6MZ3vj52LJ7Vz3o9k6qTLXSQ=3D?=
X-MS-Exchange-CrossTenant-Network-Message-Id: 234b0a40-c250-43f5-603e-08dc3ee5da06
X-MS-Exchange-CrossTenant-AuthSource: BEZP281MB2791.DEUP281.PROD.OUTLOOK.COM
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 07 Mar 2024 20:33:30.7304
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: f930300c-c97d-4019-be03-add650a171c4
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: iWpQDxTZoW6rSbrqr3JLXSbP3w2eRZJH3zX2nIvB0FRfT6XJW7apbxciqF2O/9g5f0GXOPWuZ6c/SFvFLV9ShRsjJsvqqMORuh4r49MUqtXJbM0X30hr2pcaYGb9fzt5
X-MS-Exchange-Transport-CrossTenantHeadersStamped: FR2P281MB1607
X-OriginatorOrg: aisec.fraunhofer.de

Configuring ipvs in a non-initial user namespace using the genl
netlink interface, e.g., by 'ipvsadm' is currently resulting in an
'-EPERM'. This is due to the use of GENL_ADMIN_PERM flag in
'ip_vs_ctl.c'.

Similarly to other genl interfaces, we switch to the use of
GENL_UNS_ADMIN_PERM flag which allows connection from non-initial
user namespace. Thus, it would be feasible to configure ipvs using
the genl interface also from within an unprivileged system container.

Since adding of new services and new dests are triggered from
userspace, accounting for the corresponding memory allocations in
ip_vs_new_dest() and ip_vs_add_service() is activated.

We tested this by simply running some samples from "man ipvsadm"
within an unprivileged user namespaced system container in GyroidOS.
Further, we successfully passed an adapted version of the ipvs
selftest in 'tools/testing/selftests/netfilter/ipvs.sh' using
preliminary created network namespaces from unprivileged GyroidOS
containers.

Signed-off-by: Michael Weiß <michael.weiss@aisec.fraunhofer.de>
---
 net/netfilter/ipvs/ip_vs_ctl.c | 36 +++++++++++++++++-----------------
 1 file changed, 18 insertions(+), 18 deletions(-)

diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index 143a341bbc0a..d39120c64207 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -1080,7 +1080,7 @@ ip_vs_new_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest)
 			return -EINVAL;
 	}
 
-	dest = kzalloc(sizeof(struct ip_vs_dest), GFP_KERNEL);
+	dest = kzalloc(sizeof(struct ip_vs_dest), GFP_KERNEL_ACCOUNT);
 	if (dest == NULL)
 		return -ENOMEM;
 
@@ -1421,7 +1421,7 @@ ip_vs_add_service(struct netns_ipvs *ipvs, struct ip_vs_service_user_kern *u,
 		ret_hooks = ret;
 	}
 
-	svc = kzalloc(sizeof(struct ip_vs_service), GFP_KERNEL);
+	svc = kzalloc(sizeof(struct ip_vs_service), GFP_KERNEL_ACCOUNT);
 	if (svc == NULL) {
 		IP_VS_DBG(1, "%s(): no memory\n", __func__);
 		ret = -ENOMEM;
@@ -4139,98 +4139,98 @@ static const struct genl_small_ops ip_vs_genl_ops[] = {
 	{
 		.cmd	= IPVS_CMD_NEW_SERVICE,
 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
-		.flags	= GENL_ADMIN_PERM,
+		.flags	= GENL_UNS_ADMIN_PERM,
 		.doit	= ip_vs_genl_set_cmd,
 	},
 	{
 		.cmd	= IPVS_CMD_SET_SERVICE,
 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
-		.flags	= GENL_ADMIN_PERM,
+		.flags	= GENL_UNS_ADMIN_PERM,
 		.doit	= ip_vs_genl_set_cmd,
 	},
 	{
 		.cmd	= IPVS_CMD_DEL_SERVICE,
 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
-		.flags	= GENL_ADMIN_PERM,
+		.flags	= GENL_UNS_ADMIN_PERM,
 		.doit	= ip_vs_genl_set_cmd,
 	},
 	{
 		.cmd	= IPVS_CMD_GET_SERVICE,
 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
-		.flags	= GENL_ADMIN_PERM,
+		.flags	= GENL_UNS_ADMIN_PERM,
 		.doit	= ip_vs_genl_get_cmd,
 		.dumpit	= ip_vs_genl_dump_services,
 	},
 	{
 		.cmd	= IPVS_CMD_NEW_DEST,
 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
-		.flags	= GENL_ADMIN_PERM,
+		.flags	= GENL_UNS_ADMIN_PERM,
 		.doit	= ip_vs_genl_set_cmd,
 	},
 	{
 		.cmd	= IPVS_CMD_SET_DEST,
 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
-		.flags	= GENL_ADMIN_PERM,
+		.flags	= GENL_UNS_ADMIN_PERM,
 		.doit	= ip_vs_genl_set_cmd,
 	},
 	{
 		.cmd	= IPVS_CMD_DEL_DEST,
 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
-		.flags	= GENL_ADMIN_PERM,
+		.flags	= GENL_UNS_ADMIN_PERM,
 		.doit	= ip_vs_genl_set_cmd,
 	},
 	{
 		.cmd	= IPVS_CMD_GET_DEST,
 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
-		.flags	= GENL_ADMIN_PERM,
+		.flags	= GENL_UNS_ADMIN_PERM,
 		.dumpit	= ip_vs_genl_dump_dests,
 	},
 	{
 		.cmd	= IPVS_CMD_NEW_DAEMON,
 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
-		.flags	= GENL_ADMIN_PERM,
+		.flags	= GENL_UNS_ADMIN_PERM,
 		.doit	= ip_vs_genl_set_daemon,
 	},
 	{
 		.cmd	= IPVS_CMD_DEL_DAEMON,
 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
-		.flags	= GENL_ADMIN_PERM,
+		.flags	= GENL_UNS_ADMIN_PERM,
 		.doit	= ip_vs_genl_set_daemon,
 	},
 	{
 		.cmd	= IPVS_CMD_GET_DAEMON,
 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
-		.flags	= GENL_ADMIN_PERM,
+		.flags	= GENL_UNS_ADMIN_PERM,
 		.dumpit	= ip_vs_genl_dump_daemons,
 	},
 	{
 		.cmd	= IPVS_CMD_SET_CONFIG,
 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
-		.flags	= GENL_ADMIN_PERM,
+		.flags	= GENL_UNS_ADMIN_PERM,
 		.doit	= ip_vs_genl_set_cmd,
 	},
 	{
 		.cmd	= IPVS_CMD_GET_CONFIG,
 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
-		.flags	= GENL_ADMIN_PERM,
+		.flags	= GENL_UNS_ADMIN_PERM,
 		.doit	= ip_vs_genl_get_cmd,
 	},
 	{
 		.cmd	= IPVS_CMD_GET_INFO,
 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
-		.flags	= GENL_ADMIN_PERM,
+		.flags	= GENL_UNS_ADMIN_PERM,
 		.doit	= ip_vs_genl_get_cmd,
 	},
 	{
 		.cmd	= IPVS_CMD_ZERO,
 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
-		.flags	= GENL_ADMIN_PERM,
+		.flags	= GENL_UNS_ADMIN_PERM,
 		.doit	= ip_vs_genl_set_cmd,
 	},
 	{
 		.cmd	= IPVS_CMD_FLUSH,
 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
-		.flags	= GENL_ADMIN_PERM,
+		.flags	= GENL_UNS_ADMIN_PERM,
 		.doit	= ip_vs_genl_set_cmd,
 	},
 };
-- 
2.39.2