NetBSD Problem Report #60745

From www@netbsd.org  Sat Sep 19 02:05:55 2026
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256
	 client-signature RSA-PSS (2048 bits) client-digest SHA256)
	(Client CN "mail.netbsd.org", Issuer "YR1" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id AEC611A923B
	for <gnats-bugs@gnats.NetBSD.org>; Sat, 19 Sep 2026 02:05:55 +0000 (UTC)
Message-Id: <20260919020554.6E5221A923C@mollari.NetBSD.org>
Date: Sat, 19 Sep 2026 02:05:54 +0000 (UTC)
From: campbell+netbsd@mumble.net
Reply-To: campbell+netbsd@mumble.net
To: gnats-bugs@NetBSD.org
Subject: doifioctl: priv check for SIOCSIFGENERIC
X-Send-Pr-Version: www-1.0
X-From4GNATS: "campbell+netbsd@mumble.net via gnats" <gnats-admin@NetBSD.org>

>Number:         60745
>Category:       kern
>Synopsis:       doifioctl: priv check for SIOCSIFGENERIC
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          needs-pullups
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sat Sep 19 02:10:00 +0000 2026
>Closed-Date:    
>Last-Modified:  Sat Sep 19 02:20:03 +0000 2026
>Originator:     Taylor R Campbell
>Release:        current, 11, 10, ...
>Organization:
The NetBSD Fiondactl, Ingeneric.
>Environment:
>Description:

	Various network interface drivers use ioctl(SIOCSIFGENERIC) to
	set some interface-specific configuration under an alias like
	SIOCSETVLAN.  Some drivers (such as vlan(4)) apply kauth
	checks; others (such as lagg(4)) do not.

	Since this ioctl is consistently used to make configuration
	changes, it should be consistently subject to kauth checks.

>How-To-Repeat:

	1. code inspection
	2. call ioctl(SIOCSETVLAN) unprivileged

>Fix:

	Add SIOCSIFGENERIC to the doifioctl kauth check switch:

   3498 	switch (cmd) {
   3499 	case SIOCALIFADDR:
...
   3525 	case SIOCSLINKSTR:
   3526 		if (l != NULL) {
   3527 			error = kauth_authorize_network(l->l_cred,
   3528 			    KAUTH_NETWORK_INTERFACE,
   3529 			    KAUTH_REQ_NETWORK_INTERFACE_SETPRIV, ifp,
   3530 			    KAUTH_ARG(cmd), NULL);
   3531 			if (error != 0)
   3532 				goto out;
   3533 		}
   3534 	}

	https://nxr.netbsd.org/xref/src/sys/net/if.c?r=1.538#3498

>Release-Note:

>Audit-Trail:

State-Changed-From-To: open->needs-pullups
State-Changed-By: riastradh@NetBSD.org
State-Changed-When: Sat, 19 Sep 2026 02:19:04 +0000
State-Changed-Why:
fixed in HEAD, needs pullup-11, pullup-10


From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/60745 CVS commit: src/sys/net
Date: Sat, 19 Sep 2026 02:18:12 +0000

 Module Name:	src
 Committed By:	riastradh
 Date:		Sat Sep 19 02:18:12 UTC 2026

 Modified Files:
 	src/sys/net: if.c

 Log Message:
 ioctl(SIOCSIFGENERIC): Check for network interface setpriv.

 PR kern/60745: doifioctl: priv check for SIOCSIFGENERIC


 To generate a diff of this commit:
 cvs rdiff -u -r1.538 -r1.539 src/sys/net/if.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

>Unformatted:

Home	PR Database Search