Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit aa4cf945 authored by Eric W. Biederman's avatar Eric W. Biederman Committed by David S. Miller
Browse files

net: Add variants of capable for use on netlink messages 



netlink_net_capable - The common case use, for operations that are safe on a network namespace
netlink_capable - For operations that are only known to be safe for the global root
netlink_ns_capable - The general case of capable used to handle special cases

__netlink_ns_capable - Same as netlink_ns_capable except taking a netlink_skb_parms instead of
		       the skbuff of a netlink message.

Signed-off-by: default avatar"Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent a3b299da

include/linux/netlink.h

+7 −0
Original line number Diff line number Diff line
@@ -169,4 +169,11 @@ struct netlink_tap { 
extern int netlink_add_tap(struct netlink_tap *nt);

extern int netlink_remove_tap(struct netlink_tap *nt);



bool __netlink_ns_capable(const struct netlink_skb_parms *nsp,

			  struct user_namespace *ns, int cap);

bool netlink_ns_capable(const struct sk_buff *skb,

			struct user_namespace *ns, int cap);

bool netlink_capable(const struct sk_buff *skb, int cap);

bool netlink_net_capable(const struct sk_buff *skb, int cap);



#endif	/* __LINUX_NETLINK_H */

net/netlink/af_netlink.c

+65 −0
Original line number Diff line number Diff line
@@ -1360,6 +1360,71 @@ retry: 
	return err;

}



/**

 * __netlink_ns_capable - General netlink message capability test

 * @nsp: NETLINK_CB of the socket buffer holding a netlink command from userspace.

 * @user_ns: The user namespace of the capability to use

 * @cap: The capability to use

 *

 * Test to see if the opener of the socket we received the message

 * from had when the netlink socket was created and the sender of the

 * message has has the capability @cap in the user namespace @user_ns.

 */

bool __netlink_ns_capable(const struct netlink_skb_parms *nsp,

			struct user_namespace *user_ns, int cap)

{

	return sk_ns_capable(nsp->sk, user_ns, cap);

}

EXPORT_SYMBOL(__netlink_ns_capable);



/**

 * netlink_ns_capable - General netlink message capability test

 * @skb: socket buffer holding a netlink command from userspace

 * @user_ns: The user namespace of the capability to use

 * @cap: The capability to use

 *

 * Test to see if the opener of the socket we received the message

 * from had when the netlink socket was created and the sender of the

 * message has has the capability @cap in the user namespace @user_ns.

 */

bool netlink_ns_capable(const struct sk_buff *skb,

			struct user_namespace *user_ns, int cap)

{

	return __netlink_ns_capable(&NETLINK_CB(skb), user_ns, cap);

}

EXPORT_SYMBOL(netlink_ns_capable);



/**

 * netlink_capable - Netlink global message capability test

 * @skb: socket buffer holding a netlink command from userspace

 * @cap: The capability to use

 *

 * Test to see if the opener of the socket we received the message

 * from had when the netlink socket was created and the sender of the

 * message has has the capability @cap in all user namespaces.

 */

bool netlink_capable(const struct sk_buff *skb, int cap)

{

	return netlink_ns_capable(skb, &init_user_ns, cap);

}

EXPORT_SYMBOL(netlink_capable);



/**

 * netlink_net_capable - Netlink network namespace message capability test

 * @skb: socket buffer holding a netlink command from userspace

 * @cap: The capability to use

 *

 * Test to see if the opener of the socket we received the message

 * from had when the netlink socket was created and the sender of the

 * message has has the capability @cap over the network namespace of

 * the socket we received the message from.

 */

bool netlink_net_capable(const struct sk_buff *skb, int cap)

{

	return netlink_ns_capable(skb, sock_net(skb->sk)->user_ns, cap);

}

EXPORT_SYMBOL(netlink_net_capable);



static inline int netlink_allowed(const struct socket *sock, unsigned int flag)

{

	return (nl_table[sock->sk->sk_protocol].flags & flag) ||