diff options
| author | Andrew Lutomirski <luto@amacapital.net> | 2014-04-17 04:41:34 (GMT) |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2014-04-22 16:49:39 (GMT) |
| commit | 78541c1dc60b65ecfce5a6a096fc260219d6784e (patch) | |
| tree | 45afae9a1e20fbd72426404b1d110aef9cfd6104 /net/core | |
| parent | b0bda3853266121363a5ad8c786fa82d233538c1 (diff) | |
| download | linux-78541c1dc60b65ecfce5a6a096fc260219d6784e.tar.xz | |
net: Fix ns_capable check in sock_diag_put_filterinfo
The caller needs capabilities on the namespace being queried, not on
their own namespace. This is a security bug, although it likely has
only a minor impact.
Cc: stable@vger.kernel.org
Signed-off-by: Andy Lutomirski <luto@amacapital.net>
Acked-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/core')
| -rw-r--r-- | net/core/sock_diag.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/net/core/sock_diag.c b/net/core/sock_diag.c index d7af188..9deb6ab 100644 --- a/net/core/sock_diag.c +++ b/net/core/sock_diag.c @@ -49,7 +49,7 @@ int sock_diag_put_meminfo(struct sock *sk, struct sk_buff *skb, int attrtype) } EXPORT_SYMBOL_GPL(sock_diag_put_meminfo); -int sock_diag_put_filterinfo(struct user_namespace *user_ns, struct sock *sk, +int sock_diag_put_filterinfo(struct sock *sk, struct sk_buff *skb, int attrtype) { struct sock_fprog_kern *fprog; @@ -58,7 +58,7 @@ int sock_diag_put_filterinfo(struct user_namespace *user_ns, struct sock *sk, unsigned int flen; int err = 0; - if (!ns_capable(user_ns, CAP_NET_ADMIN)) { + if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN)) { nla_reserve(skb, attrtype, 0); return 0; } |