Skip to content
  • Martin Willi's avatar
    nl80211: Allow privileged operations from user namespaces · 5617c6cd
    Martin Willi authored
    While a wiphy can be transferred to network namespaces, a process having
    CAP_NET_ADMIN in a non-initial user namespace can not administrate such
    devices due to the genetlink GENL_ADMIN_PERM restrictions.
    
    For openvswitch having the same issue, a new GENL_UNS_ADMIN_PERM flag has
    been introduced, commit 4a92602a
    
     ("openvswitch: allow management from
    inside user namespaces"). This patch changes all privileged operations
    operating on a wiphy, dev or wdev to allow their administration using the
    same mechanism. All operations use either NEED_WIPHY, NEED_WDEV or
    NEED_NETDEV, which implies a namespace aware lookup of the device. The only
    exception is NL80211_CMD_SET_WIPHY, which explicitly uses a namespace aware
    phy lookup.
    
    Signed-off-by: default avatarMartin Willi <martin@strongswan.org>
    [also allow cancel scan, for completeness]
    Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
    5617c6cd