| Message ID | 877fv4mi20.fsf_-_@x220.int.ebiederm.org |
|---|---|
| State | Accepted, archived |
| Delegated to: | David Miller |
| Headers | show |
Le 26/02/2015 23:20, Eric W. Biederman a écrit : > > When applicable verify that the caller has permisson to the underlying > network namespace for a newly created network device. > > Similary checks exist for the network namespace a network device will > be created in. > > Fixes: v4.0-rc1 Fixes: 317f4810e45e ("rtnl: allow to create device with IFLA_LINK_NETNSID set") Acked-by: Nicolas Dichtel <nicolas.dichtel@6wind.com> -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
From: ebiederm@xmission.com (Eric W. Biederman) Date: Thu, 26 Feb 2015 16:20:07 -0600 > When applicable verify that the caller has permisson to the underlying > network namespace for a newly created network device. > > Similary checks exist for the network namespace a network device will > be created in. > > Fixes: v4.0-rc1 > Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com> Applied. -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c index 155e675f656c..0a0b1c081d68 100644 --- a/net/core/rtnetlink.c +++ b/net/core/rtnetlink.c @@ -2134,6 +2134,9 @@ replay: err = -EINVAL; goto out; } + err = -EPERM; + if (!netlink_ns_capable(skb, link_net->user_ns, CAP_NET_ADMIN)) + goto out; } dev = rtnl_create_link(link_net ? : dest_net, ifname,
When applicable verify that the caller has permisson to the underlying network namespace for a newly created network device. Similary checks exist for the network namespace a network device will be created in. Fixes: v4.0-rc1 Cc: stable@vger.kernel.org Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com> --- net/core/rtnetlink.c | 3 +++ 1 file changed, 3 insertions(+)