mbox series

[0/5] Raw socket cleanups

Message ID 20190920073549.517481-1-gregkh@linuxfoundation.org
Headers show
Series Raw socket cleanups | expand

Message

Greg Kroah-Hartman Sept. 20, 2019, 7:35 a.m. UTC 
Ori Nimron pointed out that there are a number of places in the kernel
where you can create a raw socket, without having to have the
CAP_NET_RAW permission.

To resolve this, here's a short patch series to test these odd and old
protocols for this permission before allowing the creation to succeed

All patches are currently against the net tree.

thanks,

greg k-h

Ori Nimron (5):
  mISDN: enforce CAP_NET_RAW for raw sockets
  appletalk: enforce CAP_NET_RAW for raw sockets
  ax25: enforce CAP_NET_RAW for raw sockets
  ieee802154: enforce CAP_NET_RAW for raw sockets
  nfc: enforce CAP_NET_RAW for raw sockets

 drivers/isdn/mISDN/socket.c | 2 ++
 net/appletalk/ddp.c         | 5 +++++
 net/ax25/af_ax25.c          | 2 ++
 net/ieee802154/socket.c     | 3 +++
 net/nfc/llcp_sock.c         | 7 +++++--
 5 files changed, 17 insertions(+), 2 deletions(-)

Comments

David Miller Sept. 24, 2019, 2:38 p.m. UTC | #1 
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Fri, 20 Sep 2019 09:35:44 +0200

> Ori Nimron pointed out that there are a number of places in the kernel
> where you can create a raw socket, without having to have the
> CAP_NET_RAW permission.
> 
> To resolve this, here's a short patch series to test these odd and old
> protocols for this permission before allowing the creation to succeed
> 
> All patches are currently against the net tree.

Applied and queued up for -stable.