diff options
| author | Jakub Kicinski <kuba@kernel.org> | 2022-01-31 15:33:57 -0800 |
|---|---|---|
| committer | Jakub Kicinski <kuba@kernel.org> | 2022-02-01 19:59:50 -0800 |
| commit | 91f0d8a4813a9a50404b7c48a43fdc46fc77d235 (patch) | |
| tree | 6e63511e7840cfb0a502b3ace521ac59dd5af9cf | |
| parent | e4d2763f9aafd4a4780a85d4295bd4b1f5303217 (diff) | |
| download | linux-91f0d8a4813a9a50404b7c48a43fdc46fc77d235.tar.bz2 | |
net: allow SO_MARK with CAP_NET_RAW via cmsg
There's not reason SO_MARK would be allowed via setsockopt()
and not via cmsg, let's keep the two consistent. See
commit 079925cce1d0 ("net: allow SO_MARK with CAP_NET_RAW")
for justification why NET_RAW -> SO_MARK is safe.
Reviewed-by: Maciej Żenczykowski <maze@google.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Link: https://lore.kernel.org/r/20220131233357.52964-1-kuba@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
| -rw-r--r-- | net/core/sock.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/net/core/sock.c b/net/core/sock.c index d6804685f17f..09d31a7dc68f 100644 --- a/net/core/sock.c +++ b/net/core/sock.c @@ -2625,7 +2625,8 @@ int __sock_cmsg_send(struct sock *sk, struct msghdr *msg, struct cmsghdr *cmsg, switch (cmsg->cmsg_type) { case SO_MARK: - if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN)) + if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_RAW) && + !ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN)) return -EPERM; if (cmsg->cmsg_len != CMSG_LEN(sizeof(u32))) return -EINVAL; |