98 lines
3.1 KiB
Diff
98 lines
3.1 KiB
Diff
Bugzilla: 1094270
|
|
Upstream-status: 3.15 and queued for stable
|
|
|
|
From ca469eb66a7b3e97a230c750de4d01b1dc53906a Mon Sep 17 00:00:00 2001
|
|
From: "Eric W. Biederman" <ebiederm@xmission.com>
|
|
Date: Wed, 23 Apr 2014 14:26:56 -0700
|
|
Subject: [PATCH 4/6] net: Add variants of capable for use on on sockets
|
|
|
|
sk_net_capable - The common case, operations that are safe in a network namespace.
|
|
sk_capable - Operations that are not known to be safe in a network namespace
|
|
sk_ns_capable - The general case for special cases.
|
|
|
|
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
|
|
---
|
|
include/net/sock.h | 5 +++++
|
|
net/core/sock.c | 49 +++++++++++++++++++++++++++++++++++++++++++++++++
|
|
2 files changed, 54 insertions(+)
|
|
|
|
diff --git a/include/net/sock.h b/include/net/sock.h
|
|
index b9586a137cad..57c31dd15e64 100644
|
|
--- a/include/net/sock.h
|
|
+++ b/include/net/sock.h
|
|
@@ -2278,6 +2278,11 @@ int sock_get_timestampns(struct sock *, struct timespec __user *);
|
|
int sock_recv_errqueue(struct sock *sk, struct msghdr *msg, int len, int level,
|
|
int type);
|
|
|
|
+bool sk_ns_capable(const struct sock *sk,
|
|
+ struct user_namespace *user_ns, int cap);
|
|
+bool sk_capable(const struct sock *sk, int cap);
|
|
+bool sk_net_capable(const struct sock *sk, int cap);
|
|
+
|
|
/*
|
|
* Enable debug/info messages
|
|
*/
|
|
diff --git a/net/core/sock.c b/net/core/sock.c
|
|
index c0fc6bdad1e3..c8069561bdb7 100644
|
|
--- a/net/core/sock.c
|
|
+++ b/net/core/sock.c
|
|
@@ -145,6 +145,55 @@
|
|
static DEFINE_MUTEX(proto_list_mutex);
|
|
static LIST_HEAD(proto_list);
|
|
|
|
+/**
|
|
+ * sk_ns_capable - General socket capability test
|
|
+ * @sk: Socket to use a capability on or through
|
|
+ * @user_ns: The user namespace of the capability to use
|
|
+ * @cap: The capability to use
|
|
+ *
|
|
+ * Test to see if the opener of the socket had when the socket was
|
|
+ * created and the current process has the capability @cap in the user
|
|
+ * namespace @user_ns.
|
|
+ */
|
|
+bool sk_ns_capable(const struct sock *sk,
|
|
+ struct user_namespace *user_ns, int cap)
|
|
+{
|
|
+ return file_ns_capable(sk->sk_socket->file, user_ns, cap) &&
|
|
+ ns_capable(user_ns, cap);
|
|
+}
|
|
+EXPORT_SYMBOL(sk_ns_capable);
|
|
+
|
|
+/**
|
|
+ * sk_capable - Socket global capability test
|
|
+ * @sk: Socket to use a capability on or through
|
|
+ * @cap: The global capbility to use
|
|
+ *
|
|
+ * Test to see if the opener of the socket had when the socket was
|
|
+ * created and the current process has the capability @cap in all user
|
|
+ * namespaces.
|
|
+ */
|
|
+bool sk_capable(const struct sock *sk, int cap)
|
|
+{
|
|
+ return sk_ns_capable(sk, &init_user_ns, cap);
|
|
+}
|
|
+EXPORT_SYMBOL(sk_capable);
|
|
+
|
|
+/**
|
|
+ * sk_net_capable - Network namespace socket capability test
|
|
+ * @sk: Socket to use a capability on or through
|
|
+ * @cap: The capability to use
|
|
+ *
|
|
+ * Test to see if the opener of the socket had when the socke was created
|
|
+ * and the current process has the capability @cap over the network namespace
|
|
+ * the socket is a member of.
|
|
+ */
|
|
+bool sk_net_capable(const struct sock *sk, int cap)
|
|
+{
|
|
+ return sk_ns_capable(sk, sock_net(sk)->user_ns, cap);
|
|
+}
|
|
+EXPORT_SYMBOL(sk_net_capable);
|
|
+
|
|
+
|
|
#ifdef CONFIG_MEMCG_KMEM
|
|
int mem_cgroup_sockets_init(struct mem_cgroup *memcg, struct cgroup_subsys *ss)
|
|
{
|
|
--
|
|
1.9.0
|
|
|