Commit 276996fd authored by Eric W. Biederman's avatar Eric W. Biederman Committed by David S. Miller
Browse files

net: Allow the userns root to control vlans. 



Allow an unpriviled user who has created a user namespace, and then
created a network namespace to effectively use the new network
namespace, by reducing capable(CAP_NET_ADMIN) and
capable(CAP_NET_RAW) calls to be ns_capable(net->user_ns,
CAP_NET_ADMIN), or capable(net->user_ns, CAP_NET_RAW) calls.

Allow the vlan ioctls:
SET_VLAN_INGRESS_PRIORITY_CMD
SET_VLAN_EGRESS_PRIORITY_CMD
SET_VLAN_FLAG_CMD
SET_VLAN_NAME_TYPE_CMD
ADD_VLAN_CMD
DEL_VLAN_CMD

Signed-off-by: default avatar"Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent cb990503

net/8021q/vlan.c

+6 −6
Original line number Diff line number Diff line
@@ -529,7 +529,7 @@ static int vlan_ioctl_handler(struct net *net, void __user *arg) 
	switch (args.cmd) {

	case SET_VLAN_INGRESS_PRIORITY_CMD:

		err = -EPERM;

		if (!capable(CAP_NET_ADMIN))

		if (!ns_capable(net->user_ns, CAP_NET_ADMIN))

			break;

		vlan_dev_set_ingress_priority(dev,

					      args.u.skb_priority,
@@ -539,7 +539,7 @@ static int vlan_ioctl_handler(struct net *net, void __user *arg) 


	case SET_VLAN_EGRESS_PRIORITY_CMD:

		err = -EPERM;

		if (!capable(CAP_NET_ADMIN))

		if (!ns_capable(net->user_ns, CAP_NET_ADMIN))

			break;

		err = vlan_dev_set_egress_priority(dev,

						   args.u.skb_priority,
@@ -548,7 +548,7 @@ static int vlan_ioctl_handler(struct net *net, void __user *arg) 


	case SET_VLAN_FLAG_CMD:

		err = -EPERM;

		if (!capable(CAP_NET_ADMIN))

		if (!ns_capable(net->user_ns, CAP_NET_ADMIN))

			break;

		err = vlan_dev_change_flags(dev,

					    args.vlan_qos ? args.u.flag : 0,
@@ -557,7 +557,7 @@ static int vlan_ioctl_handler(struct net *net, void __user *arg) 


	case SET_VLAN_NAME_TYPE_CMD:

		err = -EPERM;

		if (!capable(CAP_NET_ADMIN))

		if (!ns_capable(net->user_ns, CAP_NET_ADMIN))

			break;

		if ((args.u.name_type >= 0) &&

		    (args.u.name_type < VLAN_NAME_TYPE_HIGHEST)) {
@@ -573,14 +573,14 @@ static int vlan_ioctl_handler(struct net *net, void __user *arg) 


	case ADD_VLAN_CMD:

		err = -EPERM;

		if (!capable(CAP_NET_ADMIN))

		if (!ns_capable(net->user_ns, CAP_NET_ADMIN))

			break;

		err = register_vlan_device(dev, args.u.VID);

		break;



	case DEL_VLAN_CMD:

		err = -EPERM;

		if (!capable(CAP_NET_ADMIN))

		if (!ns_capable(net->user_ns, CAP_NET_ADMIN))

			break;

		unregister_vlan_dev(dev, NULL);

		err = 0;

CRA Git | Maintained and supported by SUSTech CRA and CCSE