Re: [PATCH] net: qrtr: Expand control port access to root

[Manivannan Sadhasivam]

+ SELinux folks

On Fri, Feb 06, 2026 at 06:36:57PM -0800, Jakub Kicinski wrote:
> On Thu, 05 Feb 2026 13:51:31 +0530 Vishnu Santhosh wrote:
> > When qrtr is loaded as module, qrtr-ns runs from SELinux kmod_t
> > domain. On targets using upstream SELinux policies, this domain
> > does not receive CAP_NET_ADMIN, which prevents it from binding
> > control port even though qrtr-ns is a trusted system component.
> > 
> > Granting kmod_t the CAP_NET_ADMIN capability in policy is possible,
> > but not desirable, as kmod_t is not expected to perform networking
> > operations and widening its capability set is discouraged.
> > 
> > To address this in a contained way within qrtr, extend the control
> > port permission check to allow binding when either:
> > 
> >   - the process has CAP_NET_ADMIN, or
> >   - the process belongs to GLOBAL_ROOT_GID (root-equivalent tasks)
> > 
> > This permits qrtr-ns to successfully bind its control port in
> > kmod_t restricted environments without broadening SELinux capability
> > assignments.
> 
> This really feels like a one-off hack, but it's far from my area
> of expertise.. Could you get an ack or review tag from some kernel
> maintainer working on security, capabilities or permissions?

I'm also not too sure about the problem because it looks like kmod_t has almost
near root privileges, but cannot do network administration.

Maybe there is a valid reason for that?

- Mani

-- 
மணிவண்ணன் சதாசிவம்