diff options
| author | Eric W. Biederman <ebiederm@xmission.com> | 2012-11-16 03:03:07 +0000 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2012-11-18 20:32:45 -0500 |
| commit | df008c91f83583e662ac54aee00004afc3f1894d (patch) | |
| tree | 800fd831c5beb1c4ec00b41d270462d52973a425 /net/netlink/af_netlink.c | |
| parent | af31f412c7c7a3c0fda4bf4beaf0c85af1f263c8 (diff) | |
| download | linux-3.10-df008c91f83583e662ac54aee00004afc3f1894d.tar.gz linux-3.10-df008c91f83583e662ac54aee00004afc3f1894d.tar.bz2 linux-3.10-df008c91f83583e662ac54aee00004afc3f1894d.zip | |
net: Allow userns root to control llc, netfilter, netlink, packet, and xfrm
Allow an unpriviled user who has created a user namespace, and then
created a network namespace to effectively use the new network
namespace, by reducing capable(CAP_NET_ADMIN) and
capable(CAP_NET_RAW) calls to be ns_capable(net->user_ns,
CAP_NET_ADMIN), or capable(net->user_ns, CAP_NET_RAW) calls.
Allow creation of af_key sockets.
Allow creation of llc sockets.
Allow creation of af_packet sockets.
Allow sending xfrm netlink control messages.
Allow binding to netlink multicast groups.
Allow sending to netlink multicast groups.
Allow adding and dropping netlink multicast groups.
Allow sending to all netlink multicast groups and port ids.
Allow reading the netfilter SO_IP_SET socket option.
Allow sending netfilter netlink messages.
Allow setting and getting ip_vs netfilter socket options.
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/netlink/af_netlink.c')
| -rw-r--r-- | net/netlink/af_netlink.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c index 4da797fa5ec..c8a1eb6eca2 100644 --- a/net/netlink/af_netlink.c +++ b/net/netlink/af_netlink.c @@ -612,7 +612,7 @@ retry: static inline int netlink_capable(const struct socket *sock, unsigned int flag) { return (nl_table[sock->sk->sk_protocol].flags & flag) || - capable(CAP_NET_ADMIN); + ns_capable(sock_net(sock->sk)->user_ns, CAP_NET_ADMIN); } static void |