Re: netlink(4) fine grained access control

I cast level 6 necromancy.

On 9/15/25 10:45, Kristof Provost wrote:
> I’ve recently had a user raise an interesting issue (see https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=289234 )
> 
> For background: pf is in the process of converting the userspace<>kernelspace interface to netlink. This is mostly a great improvement, but it does mean that only the root user (or, the user with PRIV_NETINET_PF privilege) can get information out of pf.
> 
> That matches the default behaviour of the /dev/pf interface, but users can choose to allow other users or groups to access pf through a simple chmod/chown on /dev/pf. There’s no obvious way to do the same with netlink.
>  From a brief inspection of the code I don’t think that any such mechanism exists. I don’t particularly want to invent anything specific to pf either.
> 
> My initial impulse was to introduce a PRIV_NETINET_PF_RO priv, and to have users grant that to whatever account they’d normally allow access to /dev/pf, but the ability to set individual privileges for accounts seems to be a linux-ism (e.g. https://man7.org/linux/man-pages/man8/setcap.8.html ) and not something we can do.
> 
> So, any ideas or suggestions?
> 

genl on Linux doesn't seem to have a similar notion, beyond just not requiring privileges for some operations that just fetch statistics.  Technically you could make the relevant operations unprivileged and EPERM them after checking appropriate ucred in the handler, but that's ugly.

We're still in discussions about upstreaming a mac_bsdpriv that can grant arbitrary privileges, but I think it would also be useful to add a MAC hook into `genl_handle_message` to pass the family + command context out to MAC for evaluation.  That would open up some room for a policy that can do much finer-grained access control with just a little more MAC magic.

Thanks,

Kyle Evans