Messages in this thread Patch in this message | | | Date | Wed, 16 Apr 2008 18:01:54 -0700 | From | Chris Wright <> | Subject | LLC: Restrict LLC sockets to root |
| |
-stable review patch. If anyone has any objections, please let us know. ---------------------
From: Patrick McHardy <kaber@trash.net>
Upstream commit: 3480c63bdf008e9289aab94418f43b9592978fff
LLC currently allows users to inject raw frames, including IP packets encapsulated in SNAP. While Linux doesn't handle IP over SNAP, other systems do. Restrict LLC sockets to root similar to packet sockets.
[ Modified Patrick's patch to use CAP_NEW_RAW --DaveM ]
Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Chris Wright <chrisw@sous-sol.org> --- net/llc/af_llc.c | 3 +++ 1 file changed, 3 insertions(+)
--- a/net/llc/af_llc.c +++ b/net/llc/af_llc.c @@ -155,6 +155,9 @@ static int llc_ui_create(struct net *net struct sock *sk; int rc = -ESOCKTNOSUPPORT; + if (!capable(CAP_NET_RAW)) + return -EPERM; + if (net != &init_net) return -EAFNOSUPPORT; --
| |