From patchwork Fri Sep 2 19:56:33 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Serge E. Hallyn" X-Patchwork-Id: 113197 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 56838B6F83 for ; Sat, 3 Sep 2011 05:57:55 +1000 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755489Ab1IBT5r (ORCPT ); Fri, 2 Sep 2011 15:57:47 -0400 Received: from 50-56-35-84.static.cloud-ips.com ([50.56.35.84]:39520 "EHLO mail" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1755247Ab1IBTz7 (ORCPT ); Fri, 2 Sep 2011 15:55:59 -0400 Received: by mail (Postfix, from userid 1000) id 7C60C100F02; Fri, 2 Sep 2011 19:56:52 +0000 (UTC) From: Serge Hallyn To: akpm@osdl.org, segooon@gmail.com, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, containers@lists.linux-foundation.org, dhowells@redhat.com, ebiederm@xmission.com, rdunlap@xenotime.net Cc: "Serge E. Hallyn" , Eric Dumazet Subject: [PATCH 08/15] af_netlink.c: make netlink_capable userns-aware Date: Fri, 2 Sep 2011 19:56:33 +0000 Message-Id: <1314993400-6910-11-git-send-email-serge@hallyn.com> X-Mailer: git-send-email 1.7.0.4 In-Reply-To: <1314993400-6910-1-git-send-email-serge@hallyn.com> References: <1314993400-6910-1-git-send-email-serge@hallyn.com> Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org From: "Serge E. Hallyn" netlink_capable should check for permissions against the user namespace owning the socket in question. Changelog: Per Eric Dumazet advice, use sock_net(sk) instead of #ifdef. Signed-off-by: Serge E. Hallyn Cc: Eric W. Biederman Cc: Eric Dumazet --- net/netlink/af_netlink.c | 5 +++-- 1 files changed, 3 insertions(+), 2 deletions(-) diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c index 0a4db02..3cc0bbe 100644 --- a/net/netlink/af_netlink.c +++ b/net/netlink/af_netlink.c @@ -580,8 +580,9 @@ retry: static inline int netlink_capable(struct socket *sock, unsigned int flag) { - return (nl_table[sock->sk->sk_protocol].nl_nonroot & flag) || - capable(CAP_NET_ADMIN); + if (nl_table[sock->sk->sk_protocol].nl_nonroot & flag) + return 1; + return ns_capable(sock_net(sock->sk)->user_ns, CAP_NET_ADMIN); } static void