net: Allow userns root to control ipv4 (52e804c6) · Commits · 戴 / test

Allow an unpriviled user who has created a user namespace, and then created a network namespace to effectively use the new network namespace, by reducing capable(CAP_NET_ADMIN) and capable(CAP_NET_RAW) calls to be ns_capable(net->user_ns, CAP_NET_ADMIN), or capable(net->user_ns, CAP_NET_RAW) calls. Settings that merely control a single network device are allowed. Either the network device is a logical network device where restrictions make no difference or the network device is hardware NIC that has been explicity moved from the initial network namespace. In general policy and network stack state changes are allowed while resource control is left unchanged. Allow creating raw sockets. Allow the SIOCSARP ioctl to control the arp cache. Allow the SIOCSIFFLAG ioctl to allow setting network device flags. Allow the SIOCSIFADDR ioctl to allow setting a netdevice ipv4 address. Allow the SIOCSIFBRDADDR ioctl to allow setting a netdevice ipv4 broadcast address. Allow the SIOCSIFDSTADDR ioctl to allow setting a netdevice ipv4 destination address. Allow the SIOCSIFNETMASK ioctl to allow setting a netdevice ipv4 netmask. Allow the SIOCADDRT and SIOCDELRT ioctls to allow adding and deleting ipv4 routes. Allow the SIOCADDTUNNEL, SIOCCHGTUNNEL and SIOCDELTUNNEL ioctls for adding, changing and deleting gre tunnels. Allow the SIOCADDTUNNEL, SIOCCHGTUNNEL and SIOCDELTUNNEL ioctls for adding, changing and deleting ipip tunnels. Allow the SIOCADDTUNNEL, SIOCCHGTUNNEL and SIOCDELTUNNEL ioctls for adding, changing and deleting ipsec virtual tunnel interfaces. Allow setting the MRT_INIT, MRT_DONE, MRT_ADD_VIF, MRT_DEL_VIF, MRT_ADD_MFC, MRT_DEL_MFC, MRT_ASSERT, MRT_PIM, MRT_TABLE socket options on multicast routing sockets. Allow setting and receiving IPOPT_CIPSO, IP_OPT_SEC, IP_OPT_SID and arbitrary ip options. Allow setting IP_SEC_POLICY/IP_XFRM_POLICY ipv4 socket option. Allow setting the IP_TRANSPARENT ipv4 socket option. Allow setting the TCP_REPAIR socket option. Allow setting the TCP_CONGESTION socket option. Signed-off-by:

"Eric W. Biederman" <ebiederm@xmission.com> Signed-off-by:

David S. Miller <davem@davemloft.net>

net/ipv4/af_inet.c

+2 −1

Original line number	Diff line number	Diff line
		@@ -346,7 +346,8 @@ lookup_protocol:
		}

		err = -EPERM;
		if (sock->type == SOCK_RAW && !kern && !capable(CAP_NET_RAW))
		if (sock->type == SOCK_RAW && !kern &&
		!ns_capable(net->user_ns, CAP_NET_RAW))
		goto out_rcu_unlock;

		err = -EAFNOSUPPORT;

net/ipv4/arp.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -1161,7 +1161,7 @@ int arp_ioctl(struct net net, unsigned int cmd, void __user arg)
		switch (cmd) {
		case SIOCDARP:
		case SIOCSARP:
		if (!capable(CAP_NET_ADMIN))
		if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
		return -EPERM;
		case SIOCGARP:
		err = copy_from_user(&r, arg, sizeof(struct arpreq));

net/ipv4/devinet.c

+2 −2

Original line number	Diff line number	Diff line
		@@ -730,7 +730,7 @@ int devinet_ioctl(struct net net, unsigned int cmd, void __user arg)

		case SIOCSIFFLAGS:
		ret = -EPERM;
		if (!capable(CAP_NET_ADMIN))
		if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
		goto out;
		break;
		case SIOCSIFADDR: /* Set interface address (and family) */
		@@ -738,7 +738,7 @@ int devinet_ioctl(struct net net, unsigned int cmd, void __user arg)
		case SIOCSIFDSTADDR: /* Set the destination address */
		case SIOCSIFNETMASK: /* Set the netmask for the interface */
		ret = -EPERM;
		if (!capable(CAP_NET_ADMIN))
		if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
		goto out;
		ret = -EINVAL;
		if (sin->sin_family != AF_INET)

net/ipv4/fib_frontend.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -488,7 +488,7 @@ int ip_rt_ioctl(struct net net, unsigned int cmd, void __user arg)
		switch (cmd) {
		case SIOCADDRT: /* Add a route */
		case SIOCDELRT: /* Delete a route */
		if (!capable(CAP_NET_ADMIN))
		if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
		return -EPERM;

		if (copy_from_user(&rt, arg, sizeof(rt)))

net/ipv4/ip_gre.c

+2 −2

Original line number	Diff line number	Diff line
		@@ -1064,7 +1064,7 @@ ipgre_tunnel_ioctl (struct net_device dev, struct ifreq ifr, int cmd)
		case SIOCADDTUNNEL:
		case SIOCCHGTUNNEL:
		err = -EPERM;
		if (!capable(CAP_NET_ADMIN))
		if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
		goto done;

		err = -EFAULT;
		@@ -1139,7 +1139,7 @@ ipgre_tunnel_ioctl (struct net_device dev, struct ifreq ifr, int cmd)

		case SIOCDELTUNNEL:
		err = -EPERM;
		if (!capable(CAP_NET_ADMIN))
		if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
		goto done;

		if (dev == ign->fb_tunnel_dev) {

Admin message