Received-SPF: pass (google.com: domain of linux-kernel+bounces-96906-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:4601:e00::3 as permitted sender) client-ip=2604:1380:4601:e00::3;
IronPort-PHdr: A9a23:JIs9ZR23fLnPfzdmsmDO+QUyDhhOgF2JFhBAs8lvgudUaa3m5JTrZ
 hGBtr1m2UXEWYzL5v4DkefSurDtVT9lg96N5X4YeYFKVxgLhN9QmAolAcWfDlb8IuKsZCs/T
 4xZAURo+3ywLU9PQoPwfVTPpH214zMIXxL5MAt+POPuHYDOys+w0rPXmdXTNitSgz/vTbpuI
 UeNsA/Tu8IK065vMb04xRaMg1caUONQ2W5uORevjg7xtOKR2bMmzSlKoPMm8ZxwFIDBOokoR
 rxRCjsrdls44sHmrzDvZguC7XhPNwdemBodGSXfty7Re4/rlyujqfFAyWqkBpbPa+sKASuEz
 KpybkG1kno1biUA3jr6lZkj6cATqkelqyIm25HyT4KvONp5XZPNZJQdXWpIf9RgZSodWa+zQ
 6g/VuYbANxk8LDho1E3nCOwBxC8GuzoxDRNvXnc7JM0g+ArA1/J81IuPM9UvC3InvX3FYI7Y
 erq4qyU9SnhT/xG4i6hsYLyVBx8p/Guf71Bb/D87EoWSQDslgu6mY/IZW202sYGnjC0y/ZdZ
 /6AhDMnrjFQnzuU6pwwtIKOgYdMyHTvqgUg7d4NdN7tGwZrJN++F51IsDuGcpF7Wd4mXzRws
 T0hmdXu2La+dSkOjZkryBPcYqbbNYaS6w/lVOGfLC0+iH82ML68hhPn6UG70aW8Tci71l9Ws
 zBI2sfBrHED1hHfq4CHR/Jx813n2GOn2Rra9+dEJk45j+zcLZsgyaQ3jZ0drQLIGSqepQ==
IronPort-SDR: 65eaf3d3_darhTcbzF6nDOSwKVEvnf8OWmKPIyV/TS43zRx+7Bkvn4qx
 nxTyRGU2q43fuiFsPUvTYNl646izBe1pY8LMtXQ==
IronPort-PHdr: A9a23:+TbxMhbeJzVygfDw2tlifxb/LTFg0YqcDmcuAucPlecXIeyqqo75N
 QnE5fw30QGaFY6O8f9Agvrbv+f6VGgJ8ZuN4xVgOJAZWQUMlMMWmAItGoiCD0j6J+TtdCs0A
 IJJU1o2t2ruKkVRFc3iYEeI53Oo5CMUGhLxOBAwIeLwG4XIiN+w2fz38JrWMGAqzDroT6l1K
 UeapBnc5PILi4lvIbpj7xbSuXJHdqF36TFDIlSPkhDgo/uh5JMx1gV1lrcf+tRbUKL8LZR9a
 IcdISQtM2kz68CujhTFQQaVz1c3UmgdkUktYUDP7ETgc42qjQDfrvBY2HCFJvDnDo4PAg2Et
 JkzVznLhT4haWMjrVOOkfVe149E9UHExVR1lorYXtiNK9xRfZnRXdQ5dXpYGcFJVyVgELKOa
 ddUI+UtHtYBo5PAnWdRlAe6DzCdPO3t0y9WiXj41qgB1c4QLw+W2AYyQd0h7nr3sY/5bbsgc
 eKU6YD4x2rtaq9uxRXd55jza0x4q8uqUe92cejzxngxLS7gjWzOqqX9YRml1clX7UmXzeFND
 c2Ll1MVty5+/ziq9uYRibLl3Z4rwRfD8Hx75K1qBYSVEHYqYov3WIsVtjudMZNxWN9nWWxzp
 SImn6UPooXoFMBr4JEuxhqabuCOX6TSv1TtTu+MJzd/in9/Pr6y1F6+8kmln/X1TdL8kE1Lo
 SxMjsTWuzgT2gbS5MmKRro1/kqo1TuVkQGGwu9eKF0yla3VJoRnxbg1l5EJtl/EEDOwk0Lz5
 JI=
IronPort-Data: A9a23:ZRDzqa61L3VqHCUIwN0fhAxRtFTDchMFZxGqfqrLsTDasY5as4F+v
 jQcDG/VP6zcYGr8KN0iOt+z9B4BvcfcxtU1GQU5rng1Zn8b8sCt6fZ1gavT04N+CuWZESqLO
 u1HMoGowPgcFyKa/lH1dOG58RGQ7InQLpLkEunIJyttcgFtTSYlmHpLlvUw6mJSqYHR7zil5
 5Wq/KUzBHf/g2QoajlMu/rZwP9SlK2aVA0w7gRWic9j4Qe2e0k9VPo3Oay3Jn3kdYhYdsbSq
 zHrlezREsvxpn/BO/v9+lrJWhRiro36YWBivkFrt52K2XCukMCSPpETb5LwYW8P49mAcksYJ
 N9l7fRcQi9xVkHAdXh0vxRwS0lD0aN6FLDvYkHun++41HH6Xmayw+VHKHEMPqk65bMiaY1O3
 aRwxDEldRWfn6S70Lm7DOd2j9klLM7lMZlZtnwIITPxVKt9B8GcBfyVtJkBhmhYasNmRZ4yY
 +IcaDFvZRnEJQJCO0wMIJs/h+qjwHfleiBeqFWbqLBx72W7IAlZiuC0a4WLJIHWLSlTtgXAr
 z7D4n/VOC81CIecyBCi+DW1itaayEsXX6pXTtVU7MVCglS73XcSThcZPXO7puO8kWagVshQJ
 goS9zZopLVa3FSiRN36dxu1vHCFugIRQZxXCeJSwAKExq7Z6C6fC3QKTzpdZcZgs9U5LRQky
 XeSg8ntCDopvLD9YX6U6LqRhT+7JyUQKWgMeWkCQBdty9TvvYQ6nB/TZtlkF6Gxg5v+HjSY6
 zOXpiEWhLgJi8MPkaKh8jjvmzumq57IZhQ46gXeQiSu6QYRTIioe4Cl93DF4vtaaoWUVF+Mu
 D4Dgcf2xOQQFtSBmTKARM0TE7yzofWIKjvRhRhoBZZJ3zKg53CieZxd+nRyKVlkNu4adjLzJ
 kzeowVc4NlUJnTCRaRweY+tBs0v5a7tCdrkUuzZdJxJeJcZXAuG+jx+IE2dxWbglGAynqwlf
 5SWa8ChCTAdE6sP8datb75Aivp6mWVnmjKWHMqkiQqil7HYamScVLEFN1WDdKY14ctovTnoz
 jqWDOPToz13Xvf3fy/X9oAeNxYNK306DorxsMtZaqiIJQ8OJY3rI6S5LWoJKt05zZdG3PzF5
 G+8UUJ+wV/yzy+PYwaTZ3wpLPulUZ9jpDhpdWYhLHS56UgFOIyP1aY4c4doXL8F8Oc48+V4Y
 cNYcOq9A9NOaA/9xRIjUbfHordPSjGXlCOVHi/8YDEAb59qHAPI3dn/fzrQzioFDwvplM0Yv
 7GA/x7pcZoBTi8/Cc3TRqulylOvj30jicZ3ZU/pI8ZSSmro4oNFOyz8td5pAsAueDHo5CqW6
 BaSOjgc/dLymo4S9MLYo5yEo6OCMfpMLmADE0b1tb+JZDTnpEy9yop+YcO0VDH6VlKs3p69Z
 O9QnsrOANdekHlk64NDQqtWl4Qg7N7Spphf/ARuPFPPS3+JUrpAAH237fNjh5135I1ymFWJA
 xqU29xgJ7+2FtvvEwcRKCobf+2z76wotQeI38slAnfRxXFRx6WGY3VwLhPXqS16LZlJCq0H7
 9olmvYr712YtkJ3HPeA1jtZ5kadHEwmCq8HjKwXMKXvqwgsy2xBX6DiNz/L0MmPRuhIY2YXI
 W6ypavdhr5j6FLIXFgtGFPsg+dMp5Q8lypb7V0FJmW2nsj3udoq7htz8TgIEwNflCdD2OMuO
 VpQFlZUIJ+W9GxCn/lzXGGLGiBACiaG+0f39UA7qW3BQ2SsVU3PNGcYO9vRzHsG8mlZQCdXz
 IuYxEnhTzzuWsP7hQk2ZmJItN3hSoZX2jDZucX6AfmAIYY2UQDljoCqe2AMjRntWuE1pU/fo
 NhV7PRCUrL6OQEQsp8EJdGjj5pIcy+9JUtGXf1F14EKFzuFeDiNhB6/G3roccZJf/H34Uu0D
 vJ1Hf12VjO86T2vqw4KDqtdMp52m/8UvOA5QI3JHlJfkbWjrWtOiqnypwzen24gRut8nfktc
 r3xcy2wKU3OpH92tVKUkux6FDuWXd02ajf4/tiJy8QSNpdasOhTYUA4ibS1mHOOMTpYxRGfv
 SKdRqr41+c494ZImrn9I5V9GgybeNbBZMWVwi+OsvBlT9DGAeHRvSw793jlOAV3O+MKetJVz
 L6ijv/+7Hnnjp0XDV/LusCmOfFSxMOQWOF3DJrGHENCl3HfZP62sgoxxW+oDLdozvVf35CDb
 CmlYpKScdU1ZY9s9EdNYXIDLydHWrXFVYa+lyaTtP/WNwM81zbAJ9aZ9XPES2FXWysLGp/mA
 D/PpPecyYFEnbtIGSM7KalqM71gLH/nfJkWRdn7mD2bL2uv23epmL/pkzg+4jDqVFiANuvH4
 qz+exuvTyTq5Zn0z+xYvbIr71dTRDx4jPIrd00Qx89uhnroRCQaJOAaKtMdBosSjiX204ria
 SrQaHc5Tx/wRilAbQ629eGLst1z3QDSEoyRyuQVwn6p
IronPort-HdrOrdr: A9a23:wZH+/asZItLPzAnxfnT9SOFT7skDeNV00zEX/kB9WHVpm6uj5q
 STdZUgpHrJYVkqNE3I9eruBEDiewK/yXcW2+ks1N6ZNWGM0gaVxedZg7cKqAeQeBEWmNQ96Y
 57fOx7EtO1DVUSt7ec3DWF
Message-ID: <7113988d-3408-43b3-881e-1308c0904f2d@aisec.fraunhofer.de>
Date: Fri, 8 Mar 2024 12:17:35 +0100
User-Agent: Mozilla Thunderbird
Subject: Re: [PATCH] ipvs: allow netlink configuration from non-initial user
 namespace
Content-Language: en-US
To: Julian Anastasov <ja@ssi.bg>
CC: Simon Horman <horms@verge.net.au>, <gyroidos@aisec.fraunhofer.de>, Pablo
 Neira Ayuso <pablo@netfilter.org>, Jozsef Kadlecsik <kadlec@netfilter.org>,
	Florian Westphal <fw@strlen.de>, "David S. Miller" <davem@davemloft.net>,
	Eric Dumazet <edumazet@google.com>, Jakub Kicinski <kuba@kernel.org>, Paolo
 Abeni <pabeni@redhat.com>, <netdev@vger.kernel.org>,
	<lvs-devel@vger.kernel.org>, <netfilter-devel@vger.kernel.org>,
	<coreteam@netfilter.org>, <linux-kernel@vger.kernel.org>
References: <20240307203107.63815-1-michael.weiss@aisec.fraunhofer.de>
 <e1c8e477-ae59-48de-4aa8-e6df09013831@ssi.bg>
From: =?UTF-8?Q?Michael_Wei=C3=9F?= <michael.weiss@aisec.fraunhofer.de>
In-Reply-To: <e1c8e477-ae59-48de-4aa8-e6df09013831@ssi.bg>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Precedence: bulk
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?NnZNVXhwTmgwekxPR1FweWtuc083a0Q0bnJqakVTZzlqeVd6V2tZSUFkWVdQ?=
 =?utf-8?B?NVgvaFlHZmFLbHI5Q1BOQkI0dWpPVCtzVHRlODBaWk82b0R3WDlZMXA1NERr?=
 =?utf-8?B?K0lyOHQvY3Q5TjhTWWM4YnA5VGJCenpZMm5mZHZqNThKbGZQZ3ZyeE0yTVB3?=
 =?utf-8?B?SjVaYUdPdGJiSUE2VGdVS0hURVo3TGxsQ1E4RVBYRFVxVWhaMmwxdEEvVkxC?=
 =?utf-8?B?ZTlXSlMzaHMzU3pzemtzSk13THIwN2FEV0RBdTc1OS8wYjhRbENFRC9VdVo1?=
 =?utf-8?B?K1VzMkw0bGszWkx4VEJSS1hkZ2x3VTlPbWR3MmxVcGxSUHhML0hyOGVUVzhV?=
 =?utf-8?B?SmE1K3VocWdhOW02d254cVMwS1ZrdlUvK3RVdU5UNGlhQnNXUXBoZUlQU28v?=
 =?utf-8?B?QlJUWEF2Q1o4bDlvSDBtdk91VEdBWmZhejlzWHMvN05FSjJSQTJyUHNiTFZV?=
 =?utf-8?B?OU5aNHBYa3lsK1lmeUMwNElIWGNycVhSRjh0QWg1WWJRWHBZY2N1WThlaUNv?=
 =?utf-8?B?cHk2QnJLV2FJb1Z1OFI5NklMT2VBOTRYZFByQzdMcEthMXMraExHSTdGS2NJ?=
 =?utf-8?B?dytrL1FIM2ZRbUlhNEVDdW9yRmZxM2krdzk5QkYyd052aENHZXBwdVlCdk9K?=
 =?utf-8?B?ak9Oc3FWN0wzS29LcjR1Zkg5NWg5SlZsWlhyYkdobU1MVTdXL3puNk5razB0?=
 =?utf-8?B?VVhZdFRmT3BmU1BqcWFsV0lIc0lWaHZucnBvN2V5NEZhNndLYmV4ZEpYbit0?=
 =?utf-8?B?bmVWWmxKM2tPcWpZUXBMaUV0Tll5Vno2SFpsTGRRems3dmpDaTdvRVpKTk9u?=
 =?utf-8?B?TUdzanlZZ3hqQXhFZnpZdkFMMUVmYkFqY0VVcWlYaFk2a2RLVzYvQzBMWXlJ?=
 =?utf-8?B?Rk1XVHlQb3lrZUZ3eDhWRnM1S3NVOXM3Rlc1dzhkbHR1VnlydUtZaVJrODQ1?=
 =?utf-8?B?NDFyZVNEcWc4V0lOWkwvNFA3RTZHZ2lsbTl4RFZMTmNhMDU5dXBrS1RkSXAx?=
 =?utf-8?B?S2FFL3drSjAyc1FrNGZzMEt0TFc5OHlPYjBqbVFiZEtkZEwwMXllV29mRXFy?=
 =?utf-8?B?VmVKY0QwVDZ6c1o3Q2RGVEZtM2RCeWJuYXZ4M2tIL3NQamM4ZmJnTmVTdnZr?=
 =?utf-8?B?a3VwU1NtNkVYK3RtUlQ4ZTBReS9hWmZBd1ZoWWVHbFMvblh2VWJoUGtnVXNL?=
 =?utf-8?B?emVIZnlDTnc3dFArZTQ0bE1ITmpXSGtOQmlaUGVuZ2RvcndKUktTR1RveG5m?=
 =?utf-8?B?WlBBM3hmdVVvSGV3VFc4N2k3VWdZZFlFVVZocjNOejJwcGl0M2pVSzRCSXVP?=
 =?utf-8?B?bThtY08ycmRuYWRDRUZvK0FvOXlCM3FtNUhqVjdNSS9xZFR3Qi9ILytTZ3h3?=
 =?utf-8?B?elFBMUVVVDJPM3phVGw3MG9wcFNEdjhGL0pJUU84cTAxYnlBaVIzMVFaWnJS?=
 =?utf-8?B?bHoxYnZNbXdaUGF6SC82Z1Fxb2N5MEpiOUF5V3dMMmhnait6SWhLYUVyUVYr?=
 =?utf-8?B?YWtLZHhib0dYTjMwcGNrRVlCSTZET2wya0lLOGt2Zm9PUnUzSXZyb1dvVnBk?=
 =?utf-8?B?RXVZQ21FNHdkb0VQcTRScHRvaGpZZGh5c3d2dTVJcnMxSWhSQjUxWi94MUV5?=
 =?utf-8?B?dnA3MlVaRGVPWVZEYXdxQXR1cTFWQzRjQW1GSlJLTmViUnU3QWpZWlVKMm5V?=
 =?utf-8?B?SUxvb2lmdFYrSFdveG9OTjFxMDRVdkJzSjZ3elN2d0piRlEzaGZOZlVJTUI3?=
 =?utf-8?B?TEVHMGJZUllQK0VnT001bjBMK0E3eW1WSGR0OEd6Vm9mazBpUjhKbGU0Z1N5?=
 =?utf-8?B?SWp3SzhLWlhyb2hKbENURlQ5aDN3TitEUlRGSTFnV2dvdUtjdjVLaHRZREdC?=
 =?utf-8?B?ejhJQ1ppclgvRjVTNXVlc0NwcWlzaGg1MGJQM21PcXUxSCtKd09lUklONWMx?=
 =?utf-8?B?N1lhcFFacTNjVnJuMDJOY0dtU0s2R1FOVS9na1VtMjlyVXhFNXdONE9zUXVY?=
 =?utf-8?B?M1hoT3lBZTFEcURTbUhlNWYwOFIxdVRKdURXcXFuNzZTRFl0VFU1ZFIvQzFu?=
 =?utf-8?B?S1pDZEU2QUp2TUdZbnhBa2RKVGhOYmNLcjVSSzFpWjFncEZkNjE4OHlKMXV3?=
 =?utf-8?B?YnlCd2pBYWZsa0lUekd4M2xxQk5MRHBzQ2dyMEdaVTh5bXBVUXdjWnFkVHdq?=
 =?utf-8?B?Tm1qd3VOeFNzWVZsMityRlZkL0RwZ0dQSEF6RkdRcnV3SFd5engzUFZZMlRk?=
 =?utf-8?Q?+KwaPha4ELyF9GwNxbPSBvWE9mWYnY4vbYYJvCIpj0=3D?=
X-MS-Exchange-CrossTenant-Network-Message-Id: 8846f207-125e-43be-bfc6-08dc3f615c33
X-MS-Exchange-CrossTenant-AuthSource: BEZP281MB2791.DEUP281.PROD.OUTLOOK.COM
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 08 Mar 2024 11:17:37.3090
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: f930300c-c97d-4019-be03-add650a171c4
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: kHGDFgR9oGSf4lrLEMX6h73DDkD13q3ifqsL3LEq+/MlTaq8DuWHaEq7QyQgKdJqkuUs8HNn81i2K9dKnvKRBlmTKbMMuozmfykFkzZaSlOGQWo8umx8x1Xx/u/ZMuKb
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BEYP281MB3992
X-OriginatorOrg: aisec.fraunhofer.de

On 3/8/24 08:55, Julian Anastasov wrote:
> 
> 	Hello,
> 
> On Thu, 7 Mar 2024, Michael Weiß wrote:
> 
>> Configuring ipvs in a non-initial user namespace using the genl
>> netlink interface, e.g., by 'ipvsadm' is currently resulting in an
>> '-EPERM'. This is due to the use of GENL_ADMIN_PERM flag in
>> 'ip_vs_ctl.c'.
>>
>> Similarly to other genl interfaces, we switch to the use of
>> GENL_UNS_ADMIN_PERM flag which allows connection from non-initial
>> user namespace. Thus, it would be feasible to configure ipvs using
>> the genl interface also from within an unprivileged system container.
>>
>> Since adding of new services and new dests are triggered from
>> userspace, accounting for the corresponding memory allocations in
>> ip_vs_new_dest() and ip_vs_add_service() is activated.
>>
>> We tested this by simply running some samples from "man ipvsadm"
>> within an unprivileged user namespaced system container in GyroidOS.
>> Further, we successfully passed an adapted version of the ipvs
>> selftest in 'tools/testing/selftests/netfilter/ipvs.sh' using
>> preliminary created network namespaces from unprivileged GyroidOS
>> containers.
> 
> 	I planned such change but as followup patchset to other
> work which converts many structures to be per-netns.
> 
> 	There is a RFC v2 patchset for reference:
> 
> https://archive.linuxvirtualserver.org/html/lvs-devel/2023-12/index.html
> 
> 	My goal was to isolate the different namespaces as much as
> possible: different structures, different kthreads, etc. with the
> goal to reduce the security risks of giving power to unprivileged roots.
> Such isolation should help when namespaces are served from different CPUs.
> 
> 	May be I should push fresh v3 soon, so that we can later use
> GFP_KERNEL_ACCOUNT not only for services and dests but also
> for allocations by schedulers, estimators, etc. The access to
> sysctl vars should be enabled too, around comment
> "Don't export sysctls to unprivileged users",
> alloc_percpu => alloc_percpu_gfp(,GFP_KERNEL_ACCOUNT),
> SLAB_ACCOUNT for kmem_cache_create, not sure about __GFP_NOWARN and
> __GFP_NORETRY usage too.
> 
> 	Not sure about the sysctl vars: now they are cloned from
> init_net, do we give full access for writing, some can be privileged,
> etc.

Oh yes your right that I have missed. I think non-global per-netns
sysctls should be save to be allowed for unprivileged roots.
sysfs can only be mounted rw in a new private netns. Just unsharing the
userns which then does not own the netns, means that sysfs can only be
mounted read-only or the already mounted sysfs gets the overflow uids.

> 
> 	I didn't push such changes yet because I'm not sure what
> is needed: looks like, for now, what was needed is root from init_net to 
> control rules in different netns and there was no demand from the 
> virtualization world to extend this. If we can clearly define what is 
> good and what is bad from security perspective, we can go with such 
> changes after pushing the above patchset, i.e. the GENL_UNS_ADMIN_PERM
> change should follow all other changes.

Just to clarify the need to control ipvs from within non-init userns:
In GyroidOS, we have only a minimal ramdisk-based system containing a
container manager in the initial namespace. A first "core" container is
already running in an unprivileged user namespace with a private netns.
This container gets all physical network devices moved into its netns
and is responsible for routing and all other networking features,
ovs, batman, l2tp, etc... and also ipvs.
	
Nevertheless, it makes sense to wait for your changes to be merged first.

Thanx,
Michael


> 
>> Signed-off-by: Michael Weiß <michael.weiss@aisec.fraunhofer.de>
>> ---
>>  net/netfilter/ipvs/ip_vs_ctl.c | 36 +++++++++++++++++-----------------
>>  1 file changed, 18 insertions(+), 18 deletions(-)
>>
>> diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
>> index 143a341bbc0a..d39120c64207 100644
>> --- a/net/netfilter/ipvs/ip_vs_ctl.c
>> +++ b/net/netfilter/ipvs/ip_vs_ctl.c
>> @@ -1080,7 +1080,7 @@ ip_vs_new_dest(struct ip_vs_service *svc, struct ip_vs_dest_user_kern *udest)
>>  			return -EINVAL;
>>  	}
>>  
>> -	dest = kzalloc(sizeof(struct ip_vs_dest), GFP_KERNEL);
>> +	dest = kzalloc(sizeof(struct ip_vs_dest), GFP_KERNEL_ACCOUNT);
>>  	if (dest == NULL)
>>  		return -ENOMEM;
>>  
>> @@ -1421,7 +1421,7 @@ ip_vs_add_service(struct netns_ipvs *ipvs, struct ip_vs_service_user_kern *u,
>>  		ret_hooks = ret;
>>  	}
>>  
>> -	svc = kzalloc(sizeof(struct ip_vs_service), GFP_KERNEL);
>> +	svc = kzalloc(sizeof(struct ip_vs_service), GFP_KERNEL_ACCOUNT);
>>  	if (svc == NULL) {
>>  		IP_VS_DBG(1, "%s(): no memory\n", __func__);
>>  		ret = -ENOMEM;
>> @@ -4139,98 +4139,98 @@ static const struct genl_small_ops ip_vs_genl_ops[] = {
>>  	{
>>  		.cmd	= IPVS_CMD_NEW_SERVICE,
>>  		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
>> -		.flags	= GENL_ADMIN_PERM,
>> +		.flags	= GENL_UNS_ADMIN_PERM,
>>  		.doit	= ip_vs_genl_set_cmd,
> ...
> 
> Regards
> 
> --
> Julian Anastasov <ja@ssi.bg>