Re: [PATCH net] netdev: require admin permission for the bind-tx netlink operation

[Mina Almasry]

On Fri, Jul 24, 2026 at 8:01 AM Doruk Tan Ozturk <doruk@xxxxxxx> wrote:
>
> The netdev generic-netlink bind-rx operation (NETDEV_CMD_BIND_RX) is
> flagged uns-admin-perm, so binding a dmabuf into a device RX datapath
> requires CAP_NET_ADMIN. The symmetric bind-tx operation
> (NETDEV_CMD_BIND_TX), added later, was given no permission flag. The
> netdev family sets netnsok and has no pre_doit, and
> netdev_nl_bind_tx_doit() performs no capability check, so any
> unprivileged process can bind a dmabuf into a netmem-TX-capable device
> TX datapath.
>
> net_devmem_bind_dmabuf() attaches and DMA-maps the caller-supplied
> dmabuf to the device and installs TX device-memory state, the same
> class of privileged device operation that bind-rx restricts. Gate
> bind-tx behind uns-admin-perm to match bind-rx.
>
> Found by 0sec (https://0sec.ai).
>
> Fixes: 8802087d20c0 ("net: devmem: TCP tx netlink api")
> Cc: stable@xxxxxxxxxxxxxxx
> Assisted-by: 0sec:multi-model
> Signed-off-by: Doruk Tan Ozturk <doruk@xxxxxxx>


It's intentional that NET_ADMIN is needed for RX but not TX. Maybe add
that to the documentation.

On RX you'll see any received packets on the RX queue, so binding
memory there is sensitive. However binding a dmabuf to a netdev for TX
is not really sensitive. It's the same as sendmsg with zerocopy more
or less.

-- 
Thanks,
Mina