The branch stable/13 has been updated by zlei:
URL:
https://cgit.FreeBSD.org/src/commit/?id=310f6f2448ed5baf0d74fba7660468df84dce184
commit 310f6f2448ed5baf0d74fba7660468df84dce184
Author: Zhenlei Huang <zlei.hu...@gmail.com>
AuthorDate: 2022-10-15 15:05:36 +0000
Commit: Zhenlei Huang <z...@freebsd.org>
CommitDate: 2023-01-11 10:35:59 +0000
if_me: Use dedicated network privilege
Separate if_me privileges from if_gif.
Reviewed by: kp
Approved by: kp (mentor)
Differential Revision: https://reviews.freebsd.org/D36691
(cherry picked from commit 43f8c763cdeea29f95b6f0eebce3ad80dd210c7a)
---
sys/kern/kern_jail.c | 1 +
sys/net/if_me.c | 2 +-
sys/sys/priv.h | 1 +
3 files changed, 3 insertions(+), 1 deletion(-)
diff --git a/sys/kern/kern_jail.c b/sys/kern/kern_jail.c
index 8a3d3eb35759..1dfdb30a463c 100644
--- a/sys/kern/kern_jail.c
+++ b/sys/kern/kern_jail.c
@@ -3469,6 +3469,7 @@ prison_priv_check(struct ucred *cred, int priv)
case PRIV_NET_GIF:
case PRIV_NET_SETIFVNET:
case PRIV_NET_SETIFFIB:
+ case PRIV_NET_ME:
case PRIV_NET_WG:
/*
diff --git a/sys/net/if_me.c b/sys/net/if_me.c
index 067ab22cd84d..bcc89aa130f7 100644
--- a/sys/net/if_me.c
+++ b/sys/net/if_me.c
@@ -322,7 +322,7 @@ me_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
ifr->ifr_fib = sc->me_fibnum;
break;
case SIOCSTUNFIB:
- if ((error = priv_check(curthread, PRIV_NET_GRE)) != 0)
+ if ((error = priv_check(curthread, PRIV_NET_ME)) != 0)
break;
if (ifr->ifr_fib >= rt_numfibs)
error = EINVAL;
diff --git a/sys/sys/priv.h b/sys/sys/priv.h
index 21a969432f1a..8522231a2863 100644
--- a/sys/sys/priv.h
+++ b/sys/sys/priv.h
@@ -348,6 +348,7 @@
#define PRIV_NET_VXLAN 420 /* Administer vxlan. */
#define PRIV_NET_SETLANPCP 421 /* Set LAN priority. */
#define PRIV_NET_SETVLANPCP PRIV_NET_SETLANPCP /* Alias Set VLAN
priority */
+#define PRIV_NET_ME 423 /* Administer ME interface. */
#define PRIV_NET_WG 424 /* Administer WireGuard
interface. */
/*
