summaryrefslogtreecommitdiffstats
path: root/net/bluetooth
diff options
context:
space:
mode:
authorMarcel Holtmann <marcel@holtmann.org>2015-03-14 19:28:04 -0700
committerJohan Hedberg <johan.hedberg@intel.com>2015-03-15 09:59:18 +0200
commit1195fbb8d03e5a6d7e7e49a73592caeb113a0f70 (patch)
treed305cca349a3ac14b088f09ff1869c7fc7d43235 /net/bluetooth
parentc927a10487477eeed0441e5c88147700e69e5db9 (diff)
downloadop-kernel-dev-1195fbb8d03e5a6d7e7e49a73592caeb113a0f70.zip
op-kernel-dev-1195fbb8d03e5a6d7e7e49a73592caeb113a0f70.tar.gz
Bluetooth: Open management interface for untrusted users
Until now the management interface was restricted to CAP_NET_ADMIN. With this change every user can open the management socket. However the list of commands is heavily restricted to getting basic information about the attached controllers. No access for configuration or other operation is provided. The events are also limited. This is done so that no keys can leak or untrusted users can mess with the Bluetooth configuration. Signed-off-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Diffstat (limited to 'net/bluetooth')
-rw-r--r--net/bluetooth/hci_sock.c15
1 files changed, 6 insertions, 9 deletions
diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
index df23c18..f4b1034 100644
--- a/net/bluetooth/hci_sock.c
+++ b/net/bluetooth/hci_sock.c
@@ -795,16 +795,13 @@ static int hci_sock_bind(struct socket *sock, struct sockaddr *addr,
goto done;
}
- if (!capable(CAP_NET_ADMIN)) {
- err = -EPERM;
- goto done;
- }
-
- /* Since the access to control channels is currently
- * restricted to CAP_NET_ADMIN capabilities, every
- * socket is implicitly trusted.
+ /* Users with CAP_NET_ADMIN capabilities are allowed
+ * access to all management commands and events. For
+ * untrusted users the interface is restricted and
+ * also only untrusted events are sent.
*/
- hci_sock_set_flag(sk, HCI_SOCK_TRUSTED);
+ if (capable(CAP_NET_ADMIN))
+ hci_sock_set_flag(sk, HCI_SOCK_TRUSTED);
/* At the moment the index and unconfigured index events
* are enabled unconditionally. Setting them on each
OpenPOWER on IntegriCloud