Print this page
13992 VNIC in Zone loses access to properties

Split Close
Expand all
Collapse all
          --- old/usr/src/uts/common/io/dld/dld_drv.c
          +++ new/usr/src/uts/common/io/dld/dld_drv.c
↓ open down ↓ 14 lines elided ↑ open up ↑
  15   15   * If applicable, add the following below this CDDL HEADER, with the
  16   16   * fields enclosed by brackets "[]" replaced with your own identifying
  17   17   * information: Portions Copyright [yyyy] [name of copyright owner]
  18   18   *
  19   19   * CDDL HEADER END
  20   20   */
  21   21  /*
  22   22   * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
  23   23   * Copyright 2015, Joyent Inc.
  24   24   * Copyright (c) 2017, Joyent, Inc.
       25 + * Copyright 2025 MNX Cloud, Inc.
  25   26   */
  26   27  
  27   28  /*
  28   29   * Data-Link Driver
  29   30   */
  30   31  
  31   32  #include        <sys/conf.h>
  32   33  #include        <sys/mkdev.h>
  33   34  #include        <sys/modctl.h>
  34   35  #include        <sys/stat.h>
↓ open down ↓ 582 lines elided ↑ open up ↑
 617  618  
 618  619  done:
 619  620          if (mh != NULL)
 620  621                  dld_mac_close(mh);
 621  622          if (err == 0)
 622  623                  magp->dig_count = mac_addr_factory_num(mh) + 1;
 623  624          return (err);
 624  625  }
 625  626  
 626  627  /*
      628 + * Sometimes DLDIOC_GETMACPROP (and in the future, possibly DLDIOC_SETMACPROP)
      629 + * may be allowed to be accessed by the zone that is assigned the datalink
      630 + * device, as opposed to the zone that created the device.
      631 + */
      632 +static boolean_t
      633 +dld_macprop_assigned_zone_exception(zoneid_t zoneid, dls_dl_handle_t dlh,
      634 +    dld_ioc_macprop_t *kprop, boolean_t set)
      635 +{
      636 +        /*
      637 +         * No exceptions for setting! No exceptions unless the zoneid is
      638 +         * the assigned zone.
      639 +         */
      640 +        if (set || zoneid != dls_devnet_getzid(dlh))
      641 +                return (B_FALSE);
      642 +
      643 +        /*
      644 +         * The current list of read-only exceptions are enumerated below.
      645 +         */
      646 +        switch (kprop->pr_num) {
      647 +        case MAC_PROP_MTU:
      648 +        case MAC_PROP_STATUS:
      649 +                return (B_TRUE);
      650 +        default:
      651 +                return (B_FALSE);
      652 +        }
      653 +}
      654 +
      655 +/*
 627  656   * DLDIOC_SET/GETMACPROP
 628  657   */
 629  658  static int
 630  659  drv_ioc_prop_common(dld_ioc_macprop_t *prop, intptr_t arg, boolean_t set,
 631  660      cred_t *cred, int mode)
 632  661  {
 633  662          int                     err = EINVAL;
 634  663          dls_dl_handle_t         dlh = NULL;
 635  664          dls_link_t              *dlp = NULL;
 636  665          mac_perim_handle_t      mph = NULL;
↓ open down ↓ 35 lines elided ↑ open up ↑
 672  701          }
 673  702  
 674  703          if ((err = dls_devnet_hold_tmp(linkid, &dlh)) != 0)
 675  704                  goto done;
 676  705          if ((err = mac_perim_enter_by_macname(dls_devnet_mac(dlh), &mph)) != 0)
 677  706                  goto done;
 678  707          if ((err = dls_link_hold(dls_devnet_mac(dlh), &dlp)) != 0)
 679  708                  goto done;
 680  709  
 681  710          /*
 682      -         * Don't allow a process to get or set properties of a link if that
 683      -         * link doesn't belong to that zone.
      711 +         * In general, don't allow a process to get or set properties of a
      712 +         * link if that link doesn't belong to that zone.
      713 +         *
      714 +         * There are exceptions however, if the dlh's *assigned* zone (as
      715 +         * determined by dls_devnet_getzid()) is the one calling here.  See
      716 +         * the local function dld_macprop_assigned_zone_exception() above.
 684  717           */
 685      -        if (zoneid != dls_devnet_getownerzid(dlh)) {
      718 +        if (zoneid != dls_devnet_getownerzid(dlh) &&
      719 +            !dld_macprop_assigned_zone_exception(zoneid, dlh, kprop, set)) {
 686  720                  err = ENOENT;
 687  721                  goto done;
 688  722          }
 689  723  
 690  724          if (!mac_prop_check_size(kprop->pr_num, kprop->pr_valsize,
 691  725              kprop->pr_flags & DLD_PROP_POSSIBLE)) {
 692  726                  err = ENOBUFS;
 693  727                  goto done;
 694  728          }
 695  729  
↓ open down ↓ 1036 lines elided ↑ open up ↑
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX