lkml.org 
[lkml]   [2011]   [Jul]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 12/14] user_ns: target af_key capability check
    Date
    From: Serge E. Hallyn <serge.hallyn@canonical.com>

    This presumes that it really is complete wrt network namespaces. Looking
    at the code it appears to be.

    Signed-off-by: Serge E. Hallyn <serge.hallyn@canonical.com>
    Cc: Eric W. Biederman <ebiederm@xmission.com>
    ---
    net/key/af_key.c | 2 +-
    1 files changed, 1 insertions(+), 1 deletions(-)

    diff --git a/net/key/af_key.c b/net/key/af_key.c
    index 1e733e9..1f90f4e 100644
    --- a/net/key/af_key.c
    +++ b/net/key/af_key.c
    @@ -141,7 +141,7 @@ static int pfkey_create(struct net *net, struct socket *sock, int protocol,
    struct sock *sk;
    int err;

    - if (!capable(CAP_NET_ADMIN))
    + if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
    return -EPERM;
    if (sock->type != SOCK_RAW)
    return -ESOCKTNOSUPPORT;
    --
    1.7.4.1


    \
     
     \ /
      Last update: 2011-07-26 21:03    [W:0.021 / U:0.236 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site