diff options
| author | David Woodhouse <dwmw2@infradead.org> | 2006-06-22 16:07:52 -0700 |
|---|---|---|
| committer | David S. Miller <davem@sunset.davemloft.net> | 2006-06-23 02:07:44 -0700 |
| commit | ca6bb5d7ab22ac79f608fe6cbc6b12de6a5a19f0 (patch) | |
| tree | 7255df98fa5692c498605d2bd80402ec866f134a | |
| parent | f4b8ea7849544114e9d3d682df4d400180854677 (diff) | |
| download | linux-ca6bb5d7ab22ac79f608fe6cbc6b12de6a5a19f0.tar.gz | |
[NET]: Require CAP_NET_ADMIN to create tuntap devices.
The tuntap driver allows an admin to create persistent devices and
assign ownership of them to individual users. Unfortunately, relaxing
the permissions on the /dev/net/tun device node so that they can
actually use those devices will _also_ allow those users to create
arbitrary new devices of their own. This patch corrects that, and
adjusts the recommended permissions for the device node accordingly.
Signed-off-By: David Woodhouse <dwmw2@infradead.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
| -rw-r--r-- | Documentation/networking/tuntap.txt | 11 | ||||
| -rw-r--r-- | drivers/net/tun.c | 3 |
2 files changed, 10 insertions, 4 deletions
diff --git a/Documentation/networking/tuntap.txt b/Documentation/networking/tuntap.txt index 76750fb9151a1a..839cbb71388b3a 100644 --- a/Documentation/networking/tuntap.txt +++ b/Documentation/networking/tuntap.txt @@ -39,10 +39,13 @@ Copyright (C) 1999-2000 Maxim Krasnyansky <max_mk@yahoo.com> mknod /dev/net/tun c 10 200 Set permissions: - e.g. chmod 0700 /dev/net/tun - if you want the device only accessible by root. Giving regular users the - right to assign network devices is NOT a good idea. Users could assign - bogus network interfaces to trick firewalls or administrators. + e.g. chmod 0666 /dev/net/tun + There's no harm in allowing the device to be accessible by non-root users, + since CAP_NET_ADMIN is required for creating network devices or for + connecting to network devices which aren't owned by the user in question. + If you want to create persistent devices and give ownership of them to + unprivileged users, then you need the /dev/net/tun device to be usable by + those users. Driver module autoloading diff --git a/drivers/net/tun.c b/drivers/net/tun.c index a1ed2d9837402a..6c62d5c882683f 100644 --- a/drivers/net/tun.c +++ b/drivers/net/tun.c @@ -490,6 +490,9 @@ static int tun_set_iff(struct file *file, struct ifreq *ifr) err = -EINVAL; + if (!capable(CAP_NET_ADMIN)) + return -EPERM; + /* Set dev type */ if (ifr->ifr_flags & IFF_TUN) { /* TUN device */ |