From patchwork Fri Jul 25 08:22:26 2014 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Wang Yufen X-Patchwork-Id: 373611 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 604ED1400A0 for ; Fri, 25 Jul 2014 18:25:31 +1000 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1759952AbaGYIZX (ORCPT ); Fri, 25 Jul 2014 04:25:23 -0400 Received: from szxga01-in.huawei.com ([119.145.14.64]:63108 "EHLO szxga01-in.huawei.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752640AbaGYIZT (ORCPT ); Fri, 25 Jul 2014 04:25:19 -0400 Received: from 172.24.2.119 (EHLO SZXEML453-HUB.china.huawei.com) ([172.24.2.119]) by szxrg01-dlp.huawei.com (MOS 4.3.7-GA FastPath queued) with ESMTP id BZE55596; Fri, 25 Jul 2014 16:24:20 +0800 (CST) Received: from localhost (10.177.25.231) by SZXEML453-HUB.china.huawei.com (10.82.67.196) with Microsoft SMTP Server id 14.3.158.1; Fri, 25 Jul 2014 16:24:11 +0800 From: Wangyufen To: CC: , "Eric W. Biederman" , Wang Yufen Subject: [PATCH v2 5/8] net: Add variants of capable for use on on sockets Date: Fri, 25 Jul 2014 16:22:26 +0800 Message-ID: <1406276549-6616-6-git-send-email-wangyufen@huawei.com> X-Mailer: git-send-email 1.8.1.msysgit.1 In-Reply-To: <1406276549-6616-1-git-send-email-wangyufen@huawei.com> References: <1406276549-6616-1-git-send-email-wangyufen@huawei.com> MIME-Version: 1.0 X-Originating-IP: [10.177.25.231] X-CFilter-Loop: Reflected Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org From: "Eric W. Biederman" sk_net_capable - The common case, operations that are safe in a network namespace. sk_capable - Operations that are not known to be safe in a network namespace sk_ns_capable - The general case for special cases. Signed-off-by: "Eric W. Biederman" Signed-off-by: David S. Miller Signed-off-by: Wang Yufen --- include/net/sock.h | 5 +++++ net/core/sock.c | 49 +++++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 54 insertions(+) diff --git a/include/net/sock.h b/include/net/sock.h index f673ba5..8d4046c 100644 --- a/include/net/sock.h +++ b/include/net/sock.h @@ -2148,6 +2148,11 @@ extern void sock_enable_timestamp(struct sock *sk, int flag); extern int sock_get_timestamp(struct sock *, struct timeval __user *); extern int sock_get_timestampns(struct sock *, struct timespec __user *); +bool sk_ns_capable(const struct sock *sk, + struct user_namespace *user_ns, int cap); +bool sk_capable(const struct sock *sk, int cap); +bool sk_net_capable(const struct sock *sk, int cap); + /* * Enable debug/info messages */ diff --git a/net/core/sock.c b/net/core/sock.c index 832cf04..43854b0 100644 --- a/net/core/sock.c +++ b/net/core/sock.c @@ -139,6 +139,55 @@ static DEFINE_MUTEX(proto_list_mutex); static LIST_HEAD(proto_list); +/** + * sk_ns_capable - General socket capability test + * @sk: Socket to use a capability on or through + * @user_ns: The user namespace of the capability to use + * @cap: The capability to use + * + * Test to see if the opener of the socket had when the socket was + * created and the current process has the capability @cap in the user + * namespace @user_ns. + */ +bool sk_ns_capable(const struct sock *sk, + struct user_namespace *user_ns, int cap) +{ + return file_ns_capable(sk->sk_socket->file, user_ns, cap) && + ns_capable(user_ns, cap); +} +EXPORT_SYMBOL(sk_ns_capable); + +/** + * sk_capable - Socket global capability test + * @sk: Socket to use a capability on or through + * @cap: The global capbility to use + * + * Test to see if the opener of the socket had when the socket was + * created and the current process has the capability @cap in all user + * namespaces. + */ +bool sk_capable(const struct sock *sk, int cap) +{ + return sk_ns_capable(sk, &init_user_ns, cap); +} +EXPORT_SYMBOL(sk_capable); + +/** + * sk_net_capable - Network namespace socket capability test + * @sk: Socket to use a capability on or through + * @cap: The capability to use + * + * Test to see if the opener of the socket had when the socke was created + * and the current process has the capability @cap over the network namespace + * the socket is a member of. + */ +bool sk_net_capable(const struct sock *sk, int cap) +{ + return sk_ns_capable(sk, sock_net(sk)->user_ns, cap); +} +EXPORT_SYMBOL(sk_net_capable); + + #ifdef CONFIG_CGROUP_MEM_RES_CTLR_KMEM int mem_cgroup_sockets_init(struct cgroup *cgrp, struct cgroup_subsys *ss) {