Participant Relationship Protocol

Back to matrix

D01-AX: No

Rationale

The unprivileged NET/ROM application socket does not cover the selected endpoint control plane. In the pinned ax25-tools source, netromd receives NODES announcements and calls receive_nodes; netromr.c installs learned entries using SIOCADDRT. Periodically, netromd calls transmit_nodes; netromt.c invokes SIOCNRDECOBS to age routes. Linux v6.12 nr_ioctl explicitly checks capable(CAP_NET_ADMIN) on both commands, returning EPERM otherwise. These checks occur when the recurring operations execute, not only when a socket is opened or the interface installed. The identified Linux/netromd configuration therefore does not satisfy D01: routine operation needs an elevated network-administration actor. Moving that actor into a helper would not make the complete endpoint unprivileged under the existing criterion.

Assessment method

Recurring syscall/capability trace with explicit executable binding; no runtime test

Source context

Debian-retained ax25-tools upstream archive and Linux v6.12 source, reviewed 2026-10-22

Outstanding qualification

The No is scoped to the explicitly identified active-announcement Linux/netromd configuration, not a claim that the NET/ROM wire protocol makes every alternative implementation privileged. Application SOCK_SEQPACKET use with a provisioned UID/callsign mapping can remain unprivileged. nrattach configures an interface and exits; kissattach installs the serial line discipline and remains alive holding the attachment. Those setup/lifetime facts are separate from the decisive recurring route-maintenance checks. A pre-opened socket does not bypass nr_ioctl capability checks. Static routing without netromd, a userspace implementation, or a different kernel authority model would require a separately qualified configuration. No live serial/radio test, privilege escalation, hardware or OS change was performed.

Public sources

Editorial evidence references

The following identifiers refer to research records not included in this public package; they are not public links.