Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c48dad7e authored by Eric W. Biederman's avatar Eric W. Biederman Committed by David S. Miller
Browse files

[NET]: Disable netfilter sockopts when not in the initial network namespace 



Until we support multiple network namespaces with netfilter only allow
netfilter configuration in the initial network namespace.

Signed-off-by: default avatarEric W. Biederman <ebiederm@xmission.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent d8a5ec67

net/netfilter/nf_sockopt.c

+7 −0
Original line number Original line Diff line number Diff line
@@ -69,6 +69,9 @@ static int nf_sockopt(struct sock *sk, int pf, int val, 
	struct nf_sockopt_ops *ops;

	struct nf_sockopt_ops *ops;

	int ret;

	int ret;





	if (sk->sk_net != &init_net)

		return -ENOPROTOOPT;



	if (mutex_lock_interruptible(&nf_sockopt_mutex) != 0)

	if (mutex_lock_interruptible(&nf_sockopt_mutex) != 0)

		return -EINTR;

		return -EINTR;
@@ -125,6 +128,10 @@ static int compat_nf_sockopt(struct sock *sk, int pf, int val, 
	struct nf_sockopt_ops *ops;

	struct nf_sockopt_ops *ops;

	int ret;

	int ret;





	if (sk->sk_net != &init_net)

		return -ENOPROTOOPT;





	if (mutex_lock_interruptible(&nf_sockopt_mutex) != 0)

	if (mutex_lock_interruptible(&nf_sockopt_mutex) != 0)

		return -EINTR;

		return -EINTR;