7 files changed, 7 insertions, 7 deletions

diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 3fcfa9c59e1f..f25aac17497a 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -663,7 +663,7 @@ rtnetlink_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, int *errp)
         sz_idx = type>>2;
         kind = type&3;
 
-        if (kind != 2 && security_netlink_recv(skb)) {
+        if (kind != 2 && security_netlink_recv(skb, CAP_NET_ADMIN)) {
                 *errp = -EPERM;
                 return -1;
         }
diff --git a/net/decnet/netfilter/dn_rtmsg.c b/net/decnet/netfilter/dn_rtmsg.c
index 74133ecd7700..8b99bd33540d 100644
--- a/net/decnet/netfilter/dn_rtmsg.c
+++ b/net/decnet/netfilter/dn_rtmsg.c
@@ -107,7 +107,7 @@ static inline void dnrmg_receive_user_skb(struct sk_buff *skb)
         if (nlh->nlmsg_len < sizeof(*nlh) || skb->len < nlh->nlmsg_len)
                 return;
 
-        if (!cap_raised(NETLINK_CB(skb).eff_cap, CAP_NET_ADMIN))
+        if (security_netlink_recv(skb, CAP_NET_ADMIN))
                 RCV_SKB_FAIL(-EPERM);
 
         /* Eventually we might send routing messages too */
diff --git a/net/ipv4/netfilter/ip_queue.c b/net/ipv4/netfilter/ip_queue.c
index 213d116e5bb9..198ac36db861 100644
--- a/net/ipv4/netfilter/ip_queue.c
+++ b/net/ipv4/netfilter/ip_queue.c
@@ -515,7 +515,7 @@ ipq_rcv_skb(struct sk_buff *skb)
         if (type <= IPQM_BASE)
                 return;
                 
-        if (security_netlink_recv(skb))
+        if (security_netlink_recv(skb, CAP_NET_ADMIN))
                 RCV_SKB_FAIL(-EPERM);
         
         write_lock_bh(&queue_lock);
diff --git a/net/ipv6/netfilter/ip6_queue.c b/net/ipv6/netfilter/ip6_queue.c
index b4b7d441af25..968a14be0d05 100644
--- a/net/ipv6/netfilter/ip6_queue.c
+++ b/net/ipv6/netfilter/ip6_queue.c
@@ -505,7 +505,7 @@ ipq_rcv_skb(struct sk_buff *skb)
         if (type <= IPQM_BASE)
                 return;
         
-        if (security_netlink_recv(skb))
+        if (security_netlink_recv(skb, CAP_NET_ADMIN))
                 RCV_SKB_FAIL(-EPERM);   
 
         write_lock_bh(&queue_lock);
diff --git a/net/netfilter/nfnetlink.c b/net/netfilter/nfnetlink.c
index b88e82a1a987..ec9f0efea6bb 100644
--- a/net/netfilter/nfnetlink.c
+++ b/net/netfilter/nfnetlink.c
@@ -229,7 +229,7 @@ static int nfnetlink_rcv_msg(struct sk_buff *skb,
                  NFNL_SUBSYS_ID(nlh->nlmsg_type),
                  NFNL_MSG_TYPE(nlh->nlmsg_type));
 
-        if (!cap_raised(NETLINK_CB(skb).eff_cap, CAP_NET_ADMIN)) {
+        if (security_netlink_recv(skb, CAP_NET_ADMIN)) {
                 DEBUGP("missing CAP_NET_ADMIN\n");
                 *errp = -EPERM;
                 return -1;
diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c
index f329b72578f5..edf084becd5e 100644
--- a/net/netlink/genetlink.c
+++ b/net/netlink/genetlink.c
@@ -320,7 +320,7 @@ static int genl_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh,
                 goto errout;
         }
 
-        if ((ops->flags & GENL_ADMIN_PERM) && security_netlink_recv(skb)) {
+        if ((ops->flags & GENL_ADMIN_PERM) && security_netlink_recv(skb, CAP_NET_ADMIN)) {
                 err = -EPERM;
                 goto errout;
         }
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index c21dc26141ea..3e6a722d072e 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -1435,7 +1435,7 @@ static int xfrm_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, int *err
         link = &xfrm_dispatch[type];
 
         /* All operations require privileges, even GET */
-        if (security_netlink_recv(skb)) {
+        if (security_netlink_recv(skb, CAP_NET_ADMIN)) {
                 *errp = -EPERM;
                 return -1;
         }