net: Allow userns root to control tun and tap devices (c260b772) · Commits · 戴 / test

Allow an unpriviled user who has created a user namespace, and then created a network namespace to effectively use the new network namespace, by reducing capable(CAP_NET_ADMIN) calls to ns_capable(net->user_ns,CAP_NET_ADMIN) calls. Allow setting of the tun iff flags. Allow creating of tun devices. Allow adding a new queue to a tun device. Signed-off-by:

"Eric W. Biederman" <ebiederm@xmission.com> Acked-by:

Serge Hallyn <serge.hallyn@canonical.com> Signed-off-by:

David S. Miller <davem@davemloft.net>

drivers/net/tun.c

+3 −2

Original line number	Diff line number	Diff line
		@@ -373,10 +373,11 @@ static u16 tun_select_queue(struct net_device dev, struct sk_buff skb)
		static inline bool tun_not_capable(struct tun_struct *tun)
		{
		const struct cred *cred = current_cred();
		struct net *net = dev_net(tun->dev);

		return ((uid_valid(tun->owner) && !uid_eq(cred->euid, tun->owner)) \|\|
		(gid_valid(tun->group) && !in_egroup_p(tun->group))) &&
		!capable(CAP_NET_ADMIN);
		!ns_capable(net->user_ns, CAP_NET_ADMIN);
		}

		static void tun_set_real_num_queues(struct tun_struct *tun)
		@@ -1559,7 +1560,7 @@ static int tun_set_iff(struct net net, struct file file, struct ifreq *ifr)
		char *name;
		unsigned long flags = 0;

		if (!capable(CAP_NET_ADMIN))
		if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
		return -EPERM;
		err = security_tun_dev_create();
		if (err < 0)

Admin message