lkml.org 
[lkml]   [2008]   [Apr]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    SubjectLLC: Restrict LLC sockets to root
    -stable review patch.  If anyone has any objections, please let us know.
    ---------------------

    From: Patrick McHardy <kaber@trash.net>

    Upstream commit: 3480c63bdf008e9289aab94418f43b9592978fff

    LLC currently allows users to inject raw frames, including IP packets
    encapsulated in SNAP. While Linux doesn't handle IP over SNAP, other
    systems do. Restrict LLC sockets to root similar to packet sockets.

    [ Modified Patrick's patch to use CAP_NEW_RAW --DaveM ]

    Signed-off-by: Patrick McHardy <kaber@trash.net>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Chris Wright <chrisw@sous-sol.org>
    ---
    net/llc/af_llc.c | 3 +++
    1 file changed, 3 insertions(+)

    --- a/net/llc/af_llc.c
    +++ b/net/llc/af_llc.c
    @@ -155,6 +155,9 @@ static int llc_ui_create(struct net *net
    struct sock *sk;
    int rc = -ESOCKTNOSUPPORT;

    + if (!capable(CAP_NET_RAW))
    + return -EPERM;
    +
    if (net != &init_net)
    return -EAFNOSUPPORT;

    --


    \
     
     \ /
      Last update: 2008-04-17 03:13    [W:4.327 / U:0.920 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site