linux/net
Stephen Hemminger 4ecb90090c sysctl: allow override of /proc/sys/net with CAP_NET_ADMIN
Extend the permission check for networking sysctl's to allow modification
when current process has CAP_NET_ADMIN capability and is not root.  This
version uses the until now unused permissions hook to override the mode
value for /proc/sys/net if accessed by a user with capabilities.

Found while working with Quagga.  It is impossible to turn forwarding
on/off through the command interface because Quagga uses secure coding
practice of dropping privledges during initialization and only raising via
capabilities when necessary.  Since the dameon has reset real/effective
uid after initialization, all attempts to access /proc/sys/net variables
will fail.

Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>
Acked-by: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: Chris Wright <chrisw@sous-sol.org>
Cc: Alexey Dobriyan <adobriyan@gmail.com>
Cc: Andrew Morgan <morgan@kernel.org>
Cc: Pavel Emelyanov <xemul@openvz.org>
Cc: "David S. Miller" <davem@davemloft.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2008-07-25 10:53:45 -07:00
..
9p flag parameters: socket and socketpair 2008-07-24 10:47:27 -07:00
802 list_for_each_rcu must die: networking 2008-07-25 10:53:27 -07:00
8021q netdev: Handle ->addr_list_lock just like ->_xmit_lock for lockdep. 2008-07-22 14:16:42 -07:00
appletalk netns: Use net_eq() to compare net-namespaces for optimization. 2008-07-19 22:34:43 -07:00
atm netns: Use net_eq() to compare net-namespaces for optimization. 2008-07-19 22:34:43 -07:00
ax25 netns: Use net_eq() to compare net-namespaces for optimization. 2008-07-19 22:34:43 -07:00
bluetooth bluetooth: remove improper bluetooth class symlinks. 2008-07-21 21:54:51 -07:00
bridge netns: Use net_eq() to compare net-namespaces for optimization. 2008-07-19 22:34:43 -07:00
can netns: Use net_eq() to compare net-namespaces for optimization. 2008-07-19 22:34:43 -07:00
core printk ratelimiting rewrite 2008-07-25 10:53:29 -07:00
dccp mib: add net to NET_INC_STATS_BH 2008-07-16 20:31:16 -07:00
decnet netns: Use net_eq() to compare net-namespaces for optimization. 2008-07-19 22:34:43 -07:00
econet netns: Use net_eq() to compare net-namespaces for optimization. 2008-07-19 22:34:43 -07:00
ethernet [NET]: Return more appropriate error from eth_validate_addr(). 2008-04-13 22:45:40 -07:00
ieee80211 wext: Emit event stream entries correctly when compat. 2008-06-16 18:50:49 -07:00
ipv4 list_for_each_rcu must die: networking 2008-07-25 10:53:27 -07:00
ipv6 list_for_each_rcu must die: networking 2008-07-25 10:53:27 -07:00
ipx netns: Use net_eq() to compare net-namespaces for optimization. 2008-07-19 22:34:43 -07:00
irda Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6 2008-07-20 17:43:29 -07:00
iucv Merge branch 'linus' into cpus4096-for-linus 2008-07-21 17:19:50 +02:00
key Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6 2008-06-13 20:52:39 -07:00
lapb
llc netns: Use net_eq() to compare net-namespaces for optimization. 2008-07-19 22:34:43 -07:00
mac80211 net_sched: Add qdisc_enqueue wrapper 2008-07-20 00:08:04 -07:00
netfilter netfilter: nf_conntrack_sctp: fix sparse warnings 2008-07-21 10:11:02 -07:00
netlabel netns: Use net_eq() to compare net-namespaces for optimization. 2008-07-19 22:34:43 -07:00
netlink Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6 2008-07-05 23:08:07 -07:00
netrom netdev: Handle ->addr_list_lock just like ->_xmit_lock for lockdep. 2008-07-22 14:16:42 -07:00
packet netns: Use net_eq() to compare net-namespaces for optimization. 2008-07-19 22:34:43 -07:00
rfkill rfkill: ignore errors from rfkill_toggle_radio in rfkill_add_switch 2008-07-08 14:16:03 -04:00
rose netdev: Handle ->addr_list_lock just like ->_xmit_lock for lockdep. 2008-07-22 14:16:42 -07:00
rxrpc MIB: add struct net to UDP_INC_STATS_BH 2008-07-05 21:18:48 -07:00
sched pkt_sched: sch_sfq: dump a real number of flows 2008-07-23 21:34:27 -07:00
sctp flag parameters: socket and socketpair 2008-07-24 10:47:27 -07:00
sunrpc Merge branch 'linus' into cpus4096-for-linus 2008-07-21 17:19:50 +02:00
tipc netns: Use net_eq() to compare net-namespaces for optimization. 2008-07-19 22:34:43 -07:00
unix Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6 2008-06-28 01:19:40 -07:00
wanrouter net: Remove references to wan-router.txt in Kconfigs 2008-07-14 22:22:29 -07:00
wireless netns: Use net_eq() to compare net-namespaces for optimization. 2008-07-19 22:34:43 -07:00
x25 netns: Use net_eq() to compare net-namespaces for optimization. 2008-07-19 22:34:43 -07:00
xfrm netns: Use net_eq() to compare net-namespaces for optimization. 2008-07-19 22:34:43 -07:00
compat.c flag parameters: paccept 2008-07-24 10:47:27 -07:00
Kconfig net: Add STP demux layer 2008-07-05 21:25:39 -07:00
Makefile vlan: uninline __vlan_hwaccel_rx 2008-07-08 03:23:36 -07:00
nonet.c
socket.c flag parameters: check magic constants 2008-07-24 10:47:29 -07:00
sysctl_net.c sysctl: allow override of /proc/sys/net with CAP_NET_ADMIN 2008-07-25 10:53:45 -07:00
TUNABLE