kernel netlink

➜  net git:(6d15b70f9739) grep -rn "netlink_kernel_create"
ipv4/fib_frontend.c:1117:   sk = netlink_kernel_create(net, NETLINK_FIB_LOOKUP, &cfg);
core/sock_diag.c:324:   net->diag_nlsk = netlink_kernel_create(net, NETLINK_SOCK_DIAG, &cfg);
core/rtnetlink.c:3475:  sk = netlink_kernel_create(net, NETLINK_ROUTE, &cfg);
core/sockev_nlmcast.c:127:  socknlmsgsk = netlink_kernel_create(&init_net, NETLINK_SOCKEV, &nlcfg);
netfilter/nfnetlink.c:514:  nfnl = netlink_kernel_create(net, NETLINK_NETFILTER, &cfg);
netlink/genetlink.c:1070:   net->genl_sock = netlink_kernel_create(net, NETLINK_GENERIC, &cfg);
rmnet_data/rmnet_data_config.c:61:  return netlink_kernel_create(&init_net,
xfrm/xfrm_user.c:3146:  nlsk = netlink_kernel_create(net, NETLINK_XFRM, &cfg);

➜  net git:(6d15b70f9739) grep -rn "NL_CFG_F_NONROOT_RECV"
netlink/genetlink.c:1064:       .flags      = NL_CFG_F_NONROOT_RECV,
core/rtnetlink.c:3472:      .flags      = NL_CFG_F_NONROOT_RECV,
core/sock_diag.c:321:       .flags  = NL_CFG_F_NONROOT_RECV,

so we can use netlink fuzz general, rout, diag netlink.

kernel-create-netlink-socket.png