leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity

net: Verify permission to dest_net in newlink

Browse Source 
When applicable verify that the caller has permision to create a
network device in another network namespace.  This check is already
present when moving a network device between network namespaces in
setlink so all that is needed is to duplicate that check in newlink.

This change almost backports cleanly, but there are context conflicts
as the code that follows was added in v4.0-rc1

Fixes: b51642f6d7 net: Enable a userns root rtnl calls that are safe for unprivilged users
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Acked-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Eric W. Biederman 2015-02-26 16:19:00 -06:00 committed by David S. Miller
parent 5688714977
commit 505ce4154a
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
net/core/rtnetlink.c
View File

@ -2122,6 +2122,10 @@ replay:
if (IS_ERR(dest_net)) if (IS_ERR(dest_net))
return PTR_ERR(dest_net); return PTR_ERR(dest_net);
err = -EPERM;
if (!netlink_ns_capable(skb, dest_net->user_ns, CAP_NET_ADMIN))
goto out;
if (tb[IFLA_LINK_NETNSID]) { if (tb[IFLA_LINK_NETNSID]) {
int id = nla_get_s32(tb[IFLA_LINK_NETNSID]); int id = nla_get_s32(tb[IFLA_LINK_NETNSID]);