Messages in this thread Patch in this message | | | From | Richard Guy Briggs <> | Subject | [PATCH 3/5] audit: add netlink audit protocol bind to check capabilities on multicast join | Date | Wed, 19 Feb 2014 13:08:21 -0500 |
| |
Register a netlink per-protocol bind fuction for audit to check userspace process capabilities before allowing a multicast group connection.
Signed-off-by: Richard Guy Briggs <rgb@redhat.com> --- kernel/audit.c | 10 ++++++++++ 1 files changed, 10 insertions(+), 0 deletions(-)
diff --git a/kernel/audit.c b/kernel/audit.c index b5b2f72..f2d2d61 100644 --- a/kernel/audit.c +++ b/kernel/audit.c @@ -1050,10 +1050,20 @@ static void audit_receive(struct sk_buff *skb) mutex_unlock(&audit_cmd_mutex); } +/* Run custom bind function on netlink socket group connect or bind requests. */ +static int audit_bind(int group) +{ + if (!capable(CAP_AUDIT_READ)) + return -EPERM; + + return 0; +} + static int __net_init audit_net_init(struct net *net) { struct netlink_kernel_cfg cfg = { .input = audit_receive, + .bind = audit_bind, }; struct audit_net *aunet = net_generic(net, audit_net_id); -- 1.7.1
| |