net: Allow userns root to control the network bridge code.

Allow an unpriviled user who has created a user namespace, and then
created a network namespace to effectively use the new network
namespace, by reducing capable(CAP_NET_ADMIN) and
capable(CAP_NET_RAW) calls to be ns_capable(net->user_ns,
CAP_NET_ADMIN), or capable(net->user_ns, CAP_NET_RAW) calls.

Allow setting bridge paramters via sysfs.

Allow all of the bridge ioctls:
BRCTL_ADD_IF
BRCTL_DEL_IF
BRCTL_SET_BRDIGE_FORWARD_DELAY
BRCTL_SET_BRIDGE_HELLO_TIME
BRCTL_SET_BRIDGE_MAX_AGE
BRCTL_SET_BRIDGE_AGING_TIME
BRCTL_SET_BRIDGE_STP_STATE
BRCTL_SET_BRIDGE_PRIORITY
BRCTL_SET_PORT_PRIORITY
BRCTL_SET_PATH_COST
BRCTL_ADD_BRIDGE
BRCTL_DEL_BRDIGE

Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 5 insertions, 5 deletions

diff --git a/net/bridge/br_sysfs_br.c b/net/bridge/br_sysfs_br.c
index cffb76e2161c..5913a3a0047b 100644
--- a/net/bridge/br_sysfs_br.c
+++ b/net/bridge/br_sysfs_br.c
@@ -37,7 +37,7 @@ static ssize_t store_bridge_parm(struct device *d,
         unsigned long val;
         int err;
 
-        if (!capable(CAP_NET_ADMIN))
+        if (!ns_capable(dev_net(br->dev)->user_ns, CAP_NET_ADMIN))
                 return -EPERM;
 
         val = simple_strtoul(buf, &endp, 0);
@@ -133,7 +133,7 @@ static ssize_t store_stp_state(struct device *d,
         char *endp;
         unsigned long val;
 
-        if (!capable(CAP_NET_ADMIN))
+        if (!ns_capable(dev_net(br->dev)->user_ns, CAP_NET_ADMIN))
                 return -EPERM;
 
         val = simple_strtoul(buf, &endp, 0);
@@ -166,7 +166,7 @@ static ssize_t store_group_fwd_mask(struct device *d,
         char *endp;
         unsigned long val;
 
-        if (!capable(CAP_NET_ADMIN))
+        if (!ns_capable(dev_net(br->dev)->user_ns, CAP_NET_ADMIN))
                 return -EPERM;
 
         val = simple_strtoul(buf, &endp, 0);
@@ -301,7 +301,7 @@ static ssize_t store_group_addr(struct device *d,
         u8 new_addr[6];
         int i;
 
-        if (!capable(CAP_NET_ADMIN))
+        if (!ns_capable(dev_net(br->dev)->user_ns, CAP_NET_ADMIN))
                 return -EPERM;
 
         if (sscanf(buf, "%hhx:%hhx:%hhx:%hhx:%hhx:%hhx",
@@ -333,7 +333,7 @@ static ssize_t store_flush(struct device *d,
 {
         struct net_bridge *br = to_bridge(d);
 
-        if (!capable(CAP_NET_ADMIN))
+        if (!ns_capable(dev_net(br->dev)->user_ns, CAP_NET_ADMIN))
                 return -EPERM;
 
         br_fdb_flush(br);