diff options
| author | Mahesh Bandewar <maheshb@google.com> | 2015-06-18 18:30:54 (GMT) |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2015-06-23 10:11:52 (GMT) |
| commit | 4cd6b4754492c08f00e6237fd7e5c8b443370d15 (patch) | |
| tree | 0ce370cb5df403d33052768ec5db283cc3448180 /drivers/net/bonding/bond_sysfs.c | |
| parent | 1f02c09bc34a892b4a7c67e7ffa036b96794e69b (diff) | |
| download | linux-4cd6b4754492c08f00e6237fd7e5c8b443370d15.tar.xz | |
bonding: Display LACP info only to CAP_NET_ADMIN capable user
Actor and Partner details can be accessed via proc-fs, sys-fs
entries or netlink interface. These interfaces are world readable
at this moment. The earlier patch-series made the LACP communication
secure to avoid nuisance attack from within the same L2 domain but
it did not prevent "someone unprivileged" looking at that information
on host and perform the same act.
This patch essentially avoids spitting those entries if the user
in question does not have enough privileges.
Signed-off-by: Mahesh Bandewar <maheshb@google.com>
Signed-off-by: Andy Gospodarek <gospo@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/net/bonding/bond_sysfs.c')
| -rw-r--r-- | drivers/net/bonding/bond_sysfs.c | 12 |
1 files changed, 6 insertions, 6 deletions
diff --git a/drivers/net/bonding/bond_sysfs.c b/drivers/net/bonding/bond_sysfs.c index 143a2ab..31835a4 100644 --- a/drivers/net/bonding/bond_sysfs.c +++ b/drivers/net/bonding/bond_sysfs.c @@ -549,7 +549,7 @@ static ssize_t bonding_show_ad_actor_key(struct device *d, int count = 0; struct bonding *bond = to_bond(d); - if (BOND_MODE(bond) == BOND_MODE_8023AD) { + if (BOND_MODE(bond) == BOND_MODE_8023AD && capable(CAP_NET_ADMIN)) { struct ad_info ad_info; count = sprintf(buf, "%d\n", bond_3ad_get_active_agg_info(bond, &ad_info) @@ -569,7 +569,7 @@ static ssize_t bonding_show_ad_partner_key(struct device *d, int count = 0; struct bonding *bond = to_bond(d); - if (BOND_MODE(bond) == BOND_MODE_8023AD) { + if (BOND_MODE(bond) == BOND_MODE_8023AD && capable(CAP_NET_ADMIN)) { struct ad_info ad_info; count = sprintf(buf, "%d\n", bond_3ad_get_active_agg_info(bond, &ad_info) @@ -589,7 +589,7 @@ static ssize_t bonding_show_ad_partner_mac(struct device *d, int count = 0; struct bonding *bond = to_bond(d); - if (BOND_MODE(bond) == BOND_MODE_8023AD) { + if (BOND_MODE(bond) == BOND_MODE_8023AD && capable(CAP_NET_ADMIN)) { struct ad_info ad_info; if (!bond_3ad_get_active_agg_info(bond, &ad_info)) count = sprintf(buf, "%pM\n", ad_info.partner_system); @@ -698,7 +698,7 @@ static ssize_t bonding_show_ad_actor_sys_prio(struct device *d, { struct bonding *bond = to_bond(d); - if (BOND_MODE(bond) == BOND_MODE_8023AD) + if (BOND_MODE(bond) == BOND_MODE_8023AD && capable(CAP_NET_ADMIN)) return sprintf(buf, "%hu\n", bond->params.ad_actor_sys_prio); return 0; @@ -712,7 +712,7 @@ static ssize_t bonding_show_ad_actor_system(struct device *d, { struct bonding *bond = to_bond(d); - if (BOND_MODE(bond) == BOND_MODE_8023AD) + if (BOND_MODE(bond) == BOND_MODE_8023AD && capable(CAP_NET_ADMIN)) return sprintf(buf, "%pM\n", bond->params.ad_actor_system); return 0; @@ -727,7 +727,7 @@ static ssize_t bonding_show_ad_user_port_key(struct device *d, { struct bonding *bond = to_bond(d); - if (BOND_MODE(bond) == BOND_MODE_8023AD) + if (BOND_MODE(bond) == BOND_MODE_8023AD && capable(CAP_NET_ADMIN)) return sprintf(buf, "%hu\n", bond->params.ad_user_port_key); return 0; |