diff options
| author | Eric W. Biederman <ebiederm@xmission.com> | 2007-09-12 13:58:02 +0200 |
|---|---|---|
| committer | David S. Miller <davem@sunset.davemloft.net> | 2007-10-10 16:49:13 -0700 |
| commit | c48dad7ecd84eac92afbe02bd69fca9983a65a56 (patch) | |
| tree | d7f6fa56d7bb675c9e14d8ad4ff685213500ead8 | |
| parent | d8a5ec672768c3cf4d51d7a63fc071520afa1617 (diff) | |
| download | op-kernel-dev-c48dad7ecd84eac92afbe02bd69fca9983a65a56.zip op-kernel-dev-c48dad7ecd84eac92afbe02bd69fca9983a65a56.tar.gz | |
[NET]: Disable netfilter sockopts when not in the initial network namespace
Until we support multiple network namespaces with netfilter only allow
netfilter configuration in the initial network namespace.
Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
| -rw-r--r-- | net/netfilter/nf_sockopt.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/net/netfilter/nf_sockopt.c b/net/netfilter/nf_sockopt.c index e32761c..aa28315 100644 --- a/net/netfilter/nf_sockopt.c +++ b/net/netfilter/nf_sockopt.c @@ -69,6 +69,9 @@ static int nf_sockopt(struct sock *sk, int pf, int val, struct nf_sockopt_ops *ops; int ret; + if (sk->sk_net != &init_net) + return -ENOPROTOOPT; + if (mutex_lock_interruptible(&nf_sockopt_mutex) != 0) return -EINTR; @@ -125,6 +128,10 @@ static int compat_nf_sockopt(struct sock *sk, int pf, int val, struct nf_sockopt_ops *ops; int ret; + if (sk->sk_net != &init_net) + return -ENOPROTOOPT; + + if (mutex_lock_interruptible(&nf_sockopt_mutex) != 0) return -EINTR; |
