kern/60745: doifioctl: priv check for SIOCSIFGENERIC

["campbell+netbsd%mumble.net@localhost via gnats" <gnats-admin%NetBSD.org@localhost>]

>Number:         60745
>Category:       kern
>Synopsis:       doifioctl: priv check for SIOCSIFGENERIC
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sat Sep 19 02:10:00 +0000 2026
>Originator:     Taylor R Campbell
>Release:        current, 11, 10, ...
>Organization:
The NetBSD Fiondactl, Ingeneric.
>Environment:
>Description:

	Various network interface drivers use ioctl(SIOCSIFGENERIC) to
	set some interface-specific configuration under an alias like
	SIOCSETVLAN.  Some drivers (such as vlan(4)) apply kauth
	checks; others (such as lagg(4)) do not.

	Since this ioctl is consistently used to make configuration
	changes, it should be consistently subject to kauth checks.

>How-To-Repeat:

	1. code inspection
	2. call ioctl(SIOCSETVLAN) unprivileged

>Fix:

	Add SIOCSIFGENERIC to the doifioctl kauth check switch:

   3498 	switch (cmd) {
   3499 	case SIOCALIFADDR:
...
   3525 	case SIOCSLINKSTR:
   3526 		if (l != NULL) {
   3527 			error = kauth_authorize_network(l->l_cred,
   3528 			    KAUTH_NETWORK_INTERFACE,
   3529 			    KAUTH_REQ_NETWORK_INTERFACE_SETPRIV, ifp,
   3530 			    KAUTH_ARG(cmd), NULL);
   3531 			if (error != 0)
   3532 				goto out;
   3533 		}
   3534 	}

	https://nxr.netbsd.org/xref/src/sys/net/if.c?r=1.538#3498