summaryrefslogtreecommitdiffstats
path: root/net
diff options
context:
space:
mode:
authorEric W. Biederman <ebiederm@xmission.com>2015-02-26 16:20:07 -0600
committerDavid S. Miller <davem@davemloft.net>2015-02-28 15:14:44 -0500
commit06615bed60c1fb7c37adddb75bdc80da873b5edb (patch)
tree5aec831c22db9ff0326d701b03059b09ead59aaf /net
parent505ce4154ac86c250aa4a84a536dd9fc56479bb5 (diff)
downloadlinux-06615bed60c1fb7c37adddb75bdc80da873b5edb.tar.bz2
net: Verify permission to link_net in newlink
When applicable verify that the caller has permisson to the underlying network namespace for a newly created network device. Similary checks exist for the network namespace a network device will be created in. Fixes: 317f4810e45e ("rtnl: allow to create device with IFLA_LINK_NETNSID set") Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com> Acked-by: Nicolas Dichtel <nicolas.dichtel@6wind.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
-rw-r--r--net/core/rtnetlink.c3
1 files changed, 3 insertions, 0 deletions
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index b237959c7497..2c49355d16c2 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -2134,6 +2134,9 @@ replay:
err = -EINVAL;
goto out;
}
+ err = -EPERM;
+ if (!netlink_ns_capable(skb, link_net->user_ns, CAP_NET_ADMIN))
+ goto out;
}
dev = rtnl_create_link(link_net ? : dest_net, ifname,