diff options
author | Eric W. Biederman <ebiederm@xmission.com> | 2014-04-23 14:26:56 -0700 |
---|---|---|
committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2014-06-26 15:12:37 -0400 |
commit | c35b4e287f5ede32bae6db1aef1ae3e9174bb2ff (patch) | |
tree | 2b2e7e787a1c49166df41c0ecc2d20a3aa585730 /net/core | |
parent | f0efa2954c20ab833bf99acba0a0817f1deee9e0 (diff) | |
download | linux-3.10-c35b4e287f5ede32bae6db1aef1ae3e9174bb2ff.tar.gz linux-3.10-c35b4e287f5ede32bae6db1aef1ae3e9174bb2ff.tar.bz2 linux-3.10-c35b4e287f5ede32bae6db1aef1ae3e9174bb2ff.zip |
net: Add variants of capable for use on on sockets
[ Upstream commit a3b299da869d6e78cf42ae0b1b41797bcb8c5e4b ]
sk_net_capable - The common case, operations that are safe in a network namespace.
sk_capable - Operations that are not known to be safe in a network namespace
sk_ns_capable - The general case for special cases.
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'net/core')
-rw-r--r-- | net/core/sock.c | 49 |
1 files changed, 49 insertions, 0 deletions
diff --git a/net/core/sock.c b/net/core/sock.c index d743099250f..af65d17517b 100644 --- a/net/core/sock.c +++ b/net/core/sock.c @@ -142,6 +142,55 @@ static DEFINE_MUTEX(proto_list_mutex); static LIST_HEAD(proto_list); +/** + * sk_ns_capable - General socket capability test + * @sk: Socket to use a capability on or through + * @user_ns: The user namespace of the capability to use + * @cap: The capability to use + * + * Test to see if the opener of the socket had when the socket was + * created and the current process has the capability @cap in the user + * namespace @user_ns. + */ +bool sk_ns_capable(const struct sock *sk, + struct user_namespace *user_ns, int cap) +{ + return file_ns_capable(sk->sk_socket->file, user_ns, cap) && + ns_capable(user_ns, cap); +} +EXPORT_SYMBOL(sk_ns_capable); + +/** + * sk_capable - Socket global capability test + * @sk: Socket to use a capability on or through + * @cap: The global capbility to use + * + * Test to see if the opener of the socket had when the socket was + * created and the current process has the capability @cap in all user + * namespaces. + */ +bool sk_capable(const struct sock *sk, int cap) +{ + return sk_ns_capable(sk, &init_user_ns, cap); +} +EXPORT_SYMBOL(sk_capable); + +/** + * sk_net_capable - Network namespace socket capability test + * @sk: Socket to use a capability on or through + * @cap: The capability to use + * + * Test to see if the opener of the socket had when the socke was created + * and the current process has the capability @cap over the network namespace + * the socket is a member of. + */ +bool sk_net_capable(const struct sock *sk, int cap) +{ + return sk_ns_capable(sk, sock_net(sk)->user_ns, cap); +} +EXPORT_SYMBOL(sk_net_capable); + + #ifdef CONFIG_MEMCG_KMEM int mem_cgroup_sockets_init(struct mem_cgroup *memcg, struct cgroup_subsys *ss) { |