]> git.baikalelectronics.ru Git - kernel.git/commit
mptcp: allow privileged operations from user namespaces
authorThomas Haller <thaller@redhat.com>
Tue, 6 Sep 2022 20:55:42 +0000 (22:55 +0200)
committerPaolo Abeni <pabeni@redhat.com>
Thu, 15 Sep 2022 10:01:02 +0000 (12:01 +0200)
commit6b4859dd8dca0afa8b430b13f0c5acf7ac9d8f66
treee4124daab35e274b1193ab185434ee31722039b9
parent6ffb5ff3d3c926eb3f4869871a44a904904a4f9a
mptcp: allow privileged operations from user namespaces

GENL_ADMIN_PERM checks that the user has CAP_NET_ADMIN in the initial
namespace by calling netlink_capable(). Instead, use GENL_UNS_ADMIN_PERM
which uses netlink_ns_capable(). This checks that the caller has
CAP_NET_ADMIN in the current user namespace.

See also

  commit 8924be6e5426 ("openvswitch: allow management from inside user namespaces")

which introduced this mechanism. See also

  commit 9b4fe9101e01 ("nl80211: Allow privileged operations from user namespaces")

which introduced this for nl80211.

Signed-off-by: Thomas Haller <thaller@redhat.com>
Reviewed-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
Signed-off-by: Matthieu Baerts <matthieu.baerts@tessares.net>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
net/mptcp/pm_netlink.c