aboutsummaryrefslogtreecommitdiffstats
path: root/net/llc
diff options
context:
space:
mode:
authorEric W. Biederman <ebiederm@xmission.com>2012-11-15 22:03:07 -0500
committerDavid S. Miller <davem@davemloft.net>2012-11-18 20:32:45 -0500
commitdf008c91f83583e662ac54aee00004afc3f1894d (patch)
tree800fd831c5beb1c4ec00b41d270462d52973a425 /net/llc
parentaf31f412c7c7a3c0fda4bf4beaf0c85af1f263c8 (diff)
net: Allow userns root to control llc, netfilter, netlink, packet, and xfrm
Allow an unpriviled user who has created a user namespace, and then created a network namespace to effectively use the new network namespace, by reducing capable(CAP_NET_ADMIN) and capable(CAP_NET_RAW) calls to be ns_capable(net->user_ns, CAP_NET_ADMIN), or capable(net->user_ns, CAP_NET_RAW) calls. Allow creation of af_key sockets. Allow creation of llc sockets. Allow creation of af_packet sockets. Allow sending xfrm netlink control messages. Allow binding to netlink multicast groups. Allow sending to netlink multicast groups. Allow adding and dropping netlink multicast groups. Allow sending to all netlink multicast groups and port ids. Allow reading the netfilter SO_IP_SET socket option. Allow sending netfilter netlink messages. Allow setting and getting ip_vs netfilter socket options. Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/llc')
-rw-r--r--net/llc/af_llc.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
index c2190005a114..88709882c464 100644
--- a/net/llc/af_llc.c
+++ b/net/llc/af_llc.c
@@ -160,7 +160,7 @@ static int llc_ui_create(struct net *net, struct socket *sock, int protocol,
160 struct sock *sk; 160 struct sock *sk;
161 int rc = -ESOCKTNOSUPPORT; 161 int rc = -ESOCKTNOSUPPORT;
162 162
163 if (!capable(CAP_NET_RAW)) 163 if (!ns_capable(net->user_ns, CAP_NET_RAW))
164 return -EPERM; 164 return -EPERM;
165 165
166 if (!net_eq(net, &init_net)) 166 if (!net_eq(net, &init_net))