diff options
| author | David Woodhouse <dwmw2@infradead.org> | 2006-06-22 16:07:52 -0700 |
|---|---|---|
| committer | David S. Miller <davem@sunset.davemloft.net> | 2006-06-23 02:07:44 -0700 |
| commit | ca6bb5d7ab22ac79f608fe6cbc6b12de6a5a19f0 (patch) | |
| tree | 7255df98fa5692c498605d2bd80402ec866f134a /drivers/net/tun.c | |
| parent | f4b8ea7849544114e9d3d682df4d400180854677 (diff) | |
| download | op-kernel-dev-ca6bb5d7ab22ac79f608fe6cbc6b12de6a5a19f0.zip op-kernel-dev-ca6bb5d7ab22ac79f608fe6cbc6b12de6a5a19f0.tar.gz | |
[NET]: Require CAP_NET_ADMIN to create tuntap devices.
The tuntap driver allows an admin to create persistent devices and
assign ownership of them to individual users. Unfortunately, relaxing
the permissions on the /dev/net/tun device node so that they can
actually use those devices will _also_ allow those users to create
arbitrary new devices of their own. This patch corrects that, and
adjusts the recommended permissions for the device node accordingly.
Signed-off-By: David Woodhouse <dwmw2@infradead.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/net/tun.c')
| -rw-r--r-- | drivers/net/tun.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/net/tun.c b/drivers/net/tun.c index a1ed2d9..6c62d5c 100644 --- a/drivers/net/tun.c +++ b/drivers/net/tun.c @@ -490,6 +490,9 @@ static int tun_set_iff(struct file *file, struct ifreq *ifr) err = -EINVAL; + if (!capable(CAP_NET_ADMIN)) + return -EPERM; + /* Set dev type */ if (ifr->ifr_flags & IFF_TUN) { /* TUN device */ |
