title: How to restrict receiving a generic netlink multicast to the root user?
body: <p>I wrote a kernel module that sends generic Netlink multicasts, and wrote a userland client using libmnl that receives them.</p>
  
  <p>That all works fine, but my client works even when it's not the root user, and I want to prevent that.</p>
  
  <p>man 7 netlink says:</p>
  
  <pre><code>Only processes with an effective UID of 0 or the CAP_NET_ADMIN capability
  may send or listen to a netlink multicast group.
  </code></pre>
  
  <p>Obviously the listen part of this is not true. I've tried CentOS 5 (2.6.18), CentOS 6 (2.6.32) and Ubuntu 14.04 (3.13).</p>
  
  <p>I know that restricting receiving generic netlink commands incoming to the kernel to being only from root is possible with GENL_ADMIN_PERM flag, but is it possible to send multicasts from the kernel that can only be received by root?</p>
  
  <p>EDIT: I shared some code for a kernel module that sends netlink multicasts, and client that receives them, at <a href="https://github.com/craig65535/mcast-exmpl" rel="nofollow">https://github.com/craig65535/mcast-exmpl</a>. Build instructions are in the README.md, but I'll paste them here.</p>
  
  <p>In one terminal:</p>
  
  <pre><code>$ make
  $ sudo insmod mcast-exmpl.ko
  $ cd client
  $ make
  $ ./client
  genl ctrl msg
  Family ID: 26
  Mcast group ID: 4
  </code></pre>
  
  <p>(IDs may be different)</p>
  
  <p>In another terminal, run a command that will do a TCP connect. mcast-exmpl hooks connects via a jprobe, so doing this will cause it to send a netlink multicast.</p>
  
  <pre><code>$ nc yahoo.com 80
  ^C
  $
  </code></pre>
  
  <p>In the first terminal, you'll see a netlink multicast was received, even if you did not run client as root:</p>
  
  <pre><code>mcast-exmpl msg
  SEND_NUM 55555
  </code></pre>
  
  <p>I'd like to modify this so the multicasts are only received when <code>client</code> is running as root, or, failing that, confirmation that I've found a bug either in the Linux documentation or Linux itself.</p>