diff options
| author | Serge Hallyn <serge.hallyn@ubuntu.com> | 2011-07-26 18:58:30 +0000 |
|---|---|---|
| committer | Eric W. Biederman <ebiederm@aristanetworks.com> | 2011-08-11 10:07:51 -0500 |
| commit | 47767ff968cef285316b010f172dfb009d510b26 (patch) | |
| tree | 9aa948f1b6002eaf2686841599a8a6794daad606 | |
| parent | 329da047a95ac709628ac2c3dd0612bdb2abb3d1 (diff) | |
| download | linux-user-ns-devel-47767ff968cef285316b010f172dfb009d510b26.tar.gz | |
user namespace: use net->user_ns for some capable calls under net/
Just a partial conversion to show how the previous patch is expected to
be used.
Changelog:
6/28/11: fix typo in net/core/sock.c
7/08/11: don't target capability which authorizes module loading
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Cc: Eric W. Biederman <ebiederm@xmission.com>
| -rw-r--r-- | net/core/dev.c | 4 | ||||
| -rw-r--r-- | net/core/sock.c | 14 |
2 files changed, 10 insertions, 8 deletions
diff --git a/net/core/dev.c b/net/core/dev.c index 17d67b579beb0..6ae955f21d950 100644 --- a/net/core/dev.c +++ b/net/core/dev.c @@ -5014,7 +5014,7 @@ int dev_ioctl(struct net *net, unsigned int cmd, void __user *arg) case SIOCGMIIPHY: case SIOCGMIIREG: case SIOCSIFNAME: - if (!capable(CAP_NET_ADMIN)) + if (!ns_capable(net->user_ns, CAP_NET_ADMIN)) return -EPERM; dev_load(net, ifr.ifr_name); rtnl_lock(); @@ -5053,7 +5053,7 @@ int dev_ioctl(struct net *net, unsigned int cmd, void __user *arg) case SIOCBRADDIF: case SIOCBRDELIF: case SIOCSHWTSTAMP: - if (!capable(CAP_NET_ADMIN)) + if (!ns_capable(net->user_ns, CAP_NET_ADMIN)) return -EPERM; /* fall through */ case SIOCBONDSLAVEINFOQUERY: diff --git a/net/core/sock.c b/net/core/sock.c index bc745d00ea4dd..0f31675efc691 100644 --- a/net/core/sock.c +++ b/net/core/sock.c @@ -420,7 +420,7 @@ static int sock_bindtodevice(struct sock *sk, char __user *optval, int optlen) /* Sorry... */ ret = -EPERM; - if (!capable(CAP_NET_RAW)) + if (!ns_capable(net->user_ns, CAP_NET_RAW)) goto out; ret = -EINVAL; @@ -488,6 +488,7 @@ int sock_setsockopt(struct socket *sock, int level, int optname, int valbool; struct linger ling; int ret = 0; + struct net *net = sock_net(sk); /* * Options without arguments @@ -508,7 +509,7 @@ int sock_setsockopt(struct socket *sock, int level, int optname, switch (optname) { case SO_DEBUG: - if (val && !capable(CAP_NET_ADMIN)) + if (val && !ns_capable(net->user_ns, CAP_NET_ADMIN)) ret = -EACCES; else sock_valbool_flag(sk, SOCK_DBG, valbool); @@ -551,7 +552,7 @@ set_sndbuf: break; case SO_SNDBUFFORCE: - if (!capable(CAP_NET_ADMIN)) { + if (!ns_capable(net->user_ns, CAP_NET_ADMIN)) { ret = -EPERM; break; } @@ -589,7 +590,7 @@ set_rcvbuf: break; case SO_RCVBUFFORCE: - if (!capable(CAP_NET_ADMIN)) { + if (!ns_capable(net->user_ns, CAP_NET_ADMIN)) { ret = -EPERM; break; } @@ -612,7 +613,8 @@ set_rcvbuf: break; case SO_PRIORITY: - if ((val >= 0 && val <= 6) || capable(CAP_NET_ADMIN)) + if ((val >= 0 && val <= 6) || + ns_capable(net->user_ns, CAP_NET_ADMIN)) sk->sk_priority = val; else ret = -EPERM; @@ -729,7 +731,7 @@ set_rcvbuf: clear_bit(SOCK_PASSSEC, &sock->flags); break; case SO_MARK: - if (!capable(CAP_NET_ADMIN)) + if (!ns_capable(net->user_ns, CAP_NET_ADMIN)) ret = -EPERM; else sk->sk_mark = val; |