Message ID | 87a9uekpvw.fsf@xmission.com |
---|---|
State | Accepted, archived |
Delegated to: | David Miller |
Headers | show |
Quoting Eric W. Biederman (ebiederm@xmission.com): > > Allow an unpriviled user who has created a user namespace, and then > created a network namespace to effectively use the new network > namespace, by reducing capable(CAP_NET_ADMIN) calls to > ns_capable(net->user_ns,CAP_NET_ADMIN) calls. > > Allow setting of the tun iff flags. > Allow creating of tun devices. > Allow adding a new queue to a tun device. > Acked-by: Serge Hallyn <serge.hallyn@canonical.com> > Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com> > --- > drivers/net/tun.c | 5 +++-- > 1 files changed, 3 insertions(+), 2 deletions(-) > > diff --git a/drivers/net/tun.c b/drivers/net/tun.c > index b44d7b7..b01e8c0 100644 > --- a/drivers/net/tun.c > +++ b/drivers/net/tun.c > @@ -373,10 +373,11 @@ static u16 tun_select_queue(struct net_device *dev, struct sk_buff *skb) > static inline bool tun_not_capable(struct tun_struct *tun) > { > const struct cred *cred = current_cred(); > + struct net *net = dev_net(tun->dev); > > return ((uid_valid(tun->owner) && !uid_eq(cred->euid, tun->owner)) || > (gid_valid(tun->group) && !in_egroup_p(tun->group))) && > - !capable(CAP_NET_ADMIN); > + !ns_capable(net->user_ns, CAP_NET_ADMIN); > } > > static void tun_set_real_num_queues(struct tun_struct *tun) > @@ -1559,7 +1560,7 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr) > char *name; > unsigned long flags = 0; > > - if (!capable(CAP_NET_ADMIN)) > + if (!ns_capable(net->user_ns, CAP_NET_ADMIN)) > return -EPERM; > err = security_tun_dev_create(); > if (err < 0) > -- > 1.7.5.4 -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
From: "Serge E. Hallyn" <serge@hallyn.com> Date: Mon, 19 Nov 2012 14:23:31 +0000 > Quoting Eric W. Biederman (ebiederm@xmission.com): >> >> Allow an unpriviled user who has created a user namespace, and then >> created a network namespace to effectively use the new network >> namespace, by reducing capable(CAP_NET_ADMIN) calls to >> ns_capable(net->user_ns,CAP_NET_ADMIN) calls. >> >> Allow setting of the tun iff flags. >> Allow creating of tun devices. >> Allow adding a new queue to a tun device. >> > > Acked-by: Serge Hallyn <serge.hallyn@canonical.com> Applied. -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/drivers/net/tun.c b/drivers/net/tun.c index b44d7b7..b01e8c0 100644 --- a/drivers/net/tun.c +++ b/drivers/net/tun.c @@ -373,10 +373,11 @@ static u16 tun_select_queue(struct net_device *dev, struct sk_buff *skb) static inline bool tun_not_capable(struct tun_struct *tun) { const struct cred *cred = current_cred(); + struct net *net = dev_net(tun->dev); return ((uid_valid(tun->owner) && !uid_eq(cred->euid, tun->owner)) || (gid_valid(tun->group) && !in_egroup_p(tun->group))) && - !capable(CAP_NET_ADMIN); + !ns_capable(net->user_ns, CAP_NET_ADMIN); } static void tun_set_real_num_queues(struct tun_struct *tun) @@ -1559,7 +1560,7 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr) char *name; unsigned long flags = 0; - if (!capable(CAP_NET_ADMIN)) + if (!ns_capable(net->user_ns, CAP_NET_ADMIN)) return -EPERM; err = security_tun_dev_create(); if (err < 0)
Allow an unpriviled user who has created a user namespace, and then created a network namespace to effectively use the new network namespace, by reducing capable(CAP_NET_ADMIN) calls to ns_capable(net->user_ns,CAP_NET_ADMIN) calls. Allow setting of the tun iff flags. Allow creating of tun devices. Allow adding a new queue to a tun device. Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com> --- drivers/net/tun.c | 5 +++-- 1 files changed, 3 insertions(+), 2 deletions(-)