]> git.baikalelectronics.ru Git - kernel.git/commit
net: Don't export sysctls to unprivileged users
authorEric W. Biederman <ebiederm@xmission.com>
Fri, 16 Nov 2012 03:02:59 +0000 (03:02 +0000)
committerDavid S. Miller <davem@davemloft.net>
Mon, 19 Nov 2012 01:30:55 +0000 (20:30 -0500)
commit6b7f727c3e962d1bdfbde9106c18700cd8a26f0d
treecfaf0f43f4ce50669f07031ec42062b4c9a7f985
parent69eb7e91f037d56e983378a3ae757e334b852609
net: Don't export sysctls to unprivileged users

In preparation for supporting the creation of network namespaces
by unprivileged users, modify all of the per net sysctl exports
and refuse to allow them to unprivileged users.

This makes it safe for unprivileged users in general to access
per net sysctls, and allows sysctls to be exported to unprivileged
users on an individual basis as they are deemed safe.

Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
22 files changed:
net/core/neighbour.c
net/core/sysctl_net_core.c
net/ipv4/devinet.c
net/ipv4/ip_fragment.c
net/ipv4/route.c
net/ipv4/sysctl_net_ipv4.c
net/ipv6/addrconf.c
net/ipv6/icmp.c
net/ipv6/reassembly.c
net/ipv6/route.c
net/ipv6/sysctl_net_ipv6.c
net/netfilter/ipvs/ip_vs_ctl.c
net/netfilter/ipvs/ip_vs_lblc.c
net/netfilter/ipvs/ip_vs_lblcr.c
net/netfilter/nf_conntrack_acct.c
net/netfilter/nf_conntrack_ecache.c
net/netfilter/nf_conntrack_helper.c
net/netfilter/nf_conntrack_proto_dccp.c
net/netfilter/nf_conntrack_standalone.c
net/netfilter/nf_conntrack_timestamp.c
net/unix/sysctl_net_unix.c
net/xfrm/xfrm_sysctl.c