illumos gate

Thanks for the report. I'll take a swing at this.

After reading through the delete code path for IPv6 addresses, here is what I think is going on.

i_ipadm_delete_ipv6addrs starts by calling i_ipamd_send_ndpd_cmd . This call lands in ndpd_process_cmd which performs a check at the very beginning of the function ipadm_check_auth(). This checks for the NETWORK_INTERFACE_CONFIG_AUTH . So the if the caller has this authorization, they can get as far as deleting the address from ndpd , without pfexec or otherwise being root.

After calling i_ipadm_send_ndpd_cmd , the function i_ipadm_delete_addr is called which contains a number of system calls. In the case where the address being deleted has an lifnum of 0, i_ipadm_set_flags is called which eventually fires off an ioctl with the SIOCSLIFFLAGS command set. This command has the IPI_PRIV flag set which means it can only be called by root.

Alternatively, if the address being deleted does not have an lifnum of zero, then ioctl is called with the command set to SIOCLIFREMOVEIF which also has IPI_PRIV set.

So in either case, lifnum == 0 or lifnum != 0, the ioctl requests fired off by i_ipadm_delete_ipv6addrs requires the caller to be root. I believe this is what leads to the behavior seen in this ticket. The calling user has the NETWORK_INTERFACE_CONFIG_AUTH authorization, but is not root, so we wind up with partially deleted state where the ndpd state is wiped out, but the kernel state remains.

I'm going to try a fix where we just check for root at the beginning of i_ipadm_delete_ipv6addrs so we get all or nothing in terms of permissions.

Testing Notes¶

Here are the original repro steps with the patch applied. The partially deleted behavior no longer occurs.

ry@bld:~$ pfexec dladm create-simnet sim0
ry@bld:~$ pfexec ipadm create-addr -t -T addrconf sim0/v6
ry@bld:~$ ipadm delete-addr sim0/v6
ipadm: could not delete address: Permission denied
ry@bld:~$ pfexec ipadm delete-addr sim0/v6
ry@bld:~$ ipadm
ADDROBJ           TYPE     STATE        ADDR
lo0/v4            static   ok           127.0.0.1/8
vioif0/v4         dhcp     ok           10.47.0.179/24
lo0/v6            static   ok           ::1/128

Ryan Goodfellow wrote in #note-3:

Testing Notes¶

Here are the original repro steps with the patch applied. The partially deleted behavior no longer occurs.

[...]

Of course, when you need to have privileges to create-addr then the same privileges must be needed for delete-addr:)