From patchwork Fri Sep 2 19:56:32 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Serge E. Hallyn" X-Patchwork-Id: 113203 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 73BA7B6F83 for ; Sat, 3 Sep 2011 06:00:36 +1000 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755388Ab1IBT7n (ORCPT ); Fri, 2 Sep 2011 15:59:43 -0400 Received: from 50-56-35-84.static.cloud-ips.com ([50.56.35.84]:39511 "EHLO mail" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1755245Ab1IBTz7 (ORCPT ); Fri, 2 Sep 2011 15:55:59 -0400 Received: by mail (Postfix, from userid 1000) id 75DC2100F01; Fri, 2 Sep 2011 19:56:52 +0000 (UTC) From: Serge Hallyn To: akpm@osdl.org, segooon@gmail.com, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, containers@lists.linux-foundation.org, dhowells@redhat.com, ebiederm@xmission.com, rdunlap@xenotime.net Cc: Serge Hallyn Subject: [PATCH 07/15] user namespace: use net->user_ns for some capable calls under net/ Date: Fri, 2 Sep 2011 19:56:32 +0000 Message-Id: <1314993400-6910-10-git-send-email-serge@hallyn.com> X-Mailer: git-send-email 1.7.0.4 In-Reply-To: <1314993400-6910-1-git-send-email-serge@hallyn.com> References: <1314993400-6910-1-git-send-email-serge@hallyn.com> Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org From: Serge Hallyn Just a partial conversion to show how the previous patch is expected to be used. Changelog: 6/28/11: fix typo in net/core/sock.c 7/08/11: don't target capability which authorizes module loading Signed-off-by: Serge Hallyn Cc: Eric W. Biederman --- net/core/dev.c | 4 ++-- net/core/sock.c | 14 ++++++++------ 2 files changed, 10 insertions(+), 8 deletions(-) diff --git a/net/core/dev.c b/net/core/dev.c index 17d67b5..6ae955f 100644 --- a/net/core/dev.c +++ b/net/core/dev.c @@ -5014,7 +5014,7 @@ int dev_ioctl(struct net *net, unsigned int cmd, void __user *arg) case SIOCGMIIPHY: case SIOCGMIIREG: case SIOCSIFNAME: - if (!capable(CAP_NET_ADMIN)) + if (!ns_capable(net->user_ns, CAP_NET_ADMIN)) return -EPERM; dev_load(net, ifr.ifr_name); rtnl_lock(); @@ -5053,7 +5053,7 @@ int dev_ioctl(struct net *net, unsigned int cmd, void __user *arg) case SIOCBRADDIF: case SIOCBRDELIF: case SIOCSHWTSTAMP: - if (!capable(CAP_NET_ADMIN)) + if (!ns_capable(net->user_ns, CAP_NET_ADMIN)) return -EPERM; /* fall through */ case SIOCBONDSLAVEINFOQUERY: diff --git a/net/core/sock.c b/net/core/sock.c index bc745d0..0f31675 100644 --- a/net/core/sock.c +++ b/net/core/sock.c @@ -420,7 +420,7 @@ static int sock_bindtodevice(struct sock *sk, char __user *optval, int optlen) /* Sorry... */ ret = -EPERM; - if (!capable(CAP_NET_RAW)) + if (!ns_capable(net->user_ns, CAP_NET_RAW)) goto out; ret = -EINVAL; @@ -488,6 +488,7 @@ int sock_setsockopt(struct socket *sock, int level, int optname, int valbool; struct linger ling; int ret = 0; + struct net *net = sock_net(sk); /* * Options without arguments @@ -508,7 +509,7 @@ int sock_setsockopt(struct socket *sock, int level, int optname, switch (optname) { case SO_DEBUG: - if (val && !capable(CAP_NET_ADMIN)) + if (val && !ns_capable(net->user_ns, CAP_NET_ADMIN)) ret = -EACCES; else sock_valbool_flag(sk, SOCK_DBG, valbool); @@ -551,7 +552,7 @@ set_sndbuf: break; case SO_SNDBUFFORCE: - if (!capable(CAP_NET_ADMIN)) { + if (!ns_capable(net->user_ns, CAP_NET_ADMIN)) { ret = -EPERM; break; } @@ -589,7 +590,7 @@ set_rcvbuf: break; case SO_RCVBUFFORCE: - if (!capable(CAP_NET_ADMIN)) { + if (!ns_capable(net->user_ns, CAP_NET_ADMIN)) { ret = -EPERM; break; } @@ -612,7 +613,8 @@ set_rcvbuf: break; case SO_PRIORITY: - if ((val >= 0 && val <= 6) || capable(CAP_NET_ADMIN)) + if ((val >= 0 && val <= 6) || + ns_capable(net->user_ns, CAP_NET_ADMIN)) sk->sk_priority = val; else ret = -EPERM; @@ -729,7 +731,7 @@ set_rcvbuf: clear_bit(SOCK_PASSSEC, &sock->flags); break; case SO_MARK: - if (!capable(CAP_NET_ADMIN)) + if (!ns_capable(net->user_ns, CAP_NET_ADMIN)) ret = -EPERM; else sk->sk_mark = val;