Commit 3480c63b authored Mar 27, 2008 by Patrick McHardy Committed by David S. Miller Mar 27, 2008

[LLC]: Restrict LLC sockets to root



LLC currently allows users to inject raw frames, including IP packets
encapsulated in SNAP. While Linux doesn't handle IP over SNAP, other
systems do. Restrict LLC sockets to root similar to packet sockets.

[ Modified Patrick's patch to use CAP_NEW_RAW --DaveM ]

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent 349fb2d6

net/llc/af_llc.c

+3 −0

Original line number	Diff line number	Diff line
		@@ -155,6 +155,9 @@ static int llc_ui_create(struct net net, struct socket sock, int protocol)
		struct sock *sk;
		int rc = -ESOCKTNOSUPPORT;

		if (!capable(CAP_NET_RAW))
		return -EPERM;

		if (net != &init_net)
		return -EAFNOSUPPORT;

Admin message