Commit 73f7ef43 authored by Eric W. Biederman's avatar Eric W. Biederman Committed by David S. Miller
Browse files

sysctl: Pass useful parameters to sysctl permissions 



- Current is implicitly avaiable so passing current->nsproxy isn't useful.
- The ctl_table_header is needed to find how the sysctl table is connected
  to the rest of sysctl.
- ctl_table_root is avaiable in the ctl_table_header so no need to it.

With these changes it becomes possible to write a version of
net_sysctl_permission that takes into account the network namespace of
the sysctl table, an important feature in extending the user namespace.

Acked-by: default avatarSerge Hallyn <serge.hallyn@canonical.com>
Signed-off-by: default avatar"Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent d328b836

fs/proc/proc_sysctl.c

+5 −4
Original line number Diff line number Diff line
@@ -378,12 +378,13 @@ static int test_perm(int mode, int op) 
	return -EACCES;

}



static int sysctl_perm(struct ctl_table_root *root, struct ctl_table *table, int op)

static int sysctl_perm(struct ctl_table_header *head, struct ctl_table *table, int op)

{

	struct ctl_table_root *root = head->root;

	int mode;



	if (root->permissions)

		mode = root->permissions(root, current->nsproxy, table);

		mode = root->permissions(head, table);

	else

		mode = table->mode;
@@ -491,7 +492,7 @@ static ssize_t proc_sys_call_handler(struct file *filp, void __user *buf, 
	 * and won't be until we finish.

	 */

	error = -EPERM;

	if (sysctl_perm(head->root, table, write ? MAY_WRITE : MAY_READ))

	if (sysctl_perm(head, table, write ? MAY_WRITE : MAY_READ))

		goto out;



	/* if that can happen at all, it should be -EINVAL, not -EISDIR */
@@ -717,7 +718,7 @@ static int proc_sys_permission(struct inode *inode, int mask) 
	if (!table) /* global root - r-xr-xr-x */

		error = mask & MAY_WRITE ? -EACCES : 0;

	else /* Use the permissions on the sysctl table entry */

		error = sysctl_perm(head->root, table, mask & ~MAY_NOT_BLOCK);

		error = sysctl_perm(head, table, mask & ~MAY_NOT_BLOCK);



	sysctl_head_finish(head);

	return error;

include/linux/sysctl.h

+1 −2
Original line number Diff line number Diff line
@@ -158,8 +158,7 @@ struct ctl_table_root { 
	struct ctl_table_set default_set;

	struct ctl_table_set *(*lookup)(struct ctl_table_root *root,

					   struct nsproxy *namespaces);

	int (*permissions)(struct ctl_table_root *root,

			struct nsproxy *namespaces, struct ctl_table *table);

	int (*permissions)(struct ctl_table_header *head, struct ctl_table *table);

};



/* struct ctl_path describes where in the hierarchy a table is added */

net/sysctl_net.c

+1 −2
Original line number Diff line number Diff line
@@ -38,8 +38,7 @@ static int is_seen(struct ctl_table_set *set) 
}



/* Return standard mode bits for table entry. */

static int net_ctl_permissions(struct ctl_table_root *root,

			       struct nsproxy *nsproxy,

static int net_ctl_permissions(struct ctl_table_header *head,

			       struct ctl_table *table)

{

	/* Allow network administrator to have same access as root. */

CRA Git | Maintained and supported by SUSTech CRA and CCSE