summaryrefslogtreecommitdiffstats
path: root/net/ipv6/ipv6_sockglue.c
diff options
context:
space:
mode:
authorHerbert Xu <herbert@gondor.apana.org.au>2005-08-06 06:33:15 -0700
committerDavid S. Miller <davem@davemloft.net>2005-08-06 06:33:15 -0700
commit6fc0b4a7a73a81e74d0004732df358f4f9975be2 (patch)
treeac2c68e206efbfe378728a50be30ef0bccd0cdff /net/ipv6/ipv6_sockglue.c
parent534afb90a9cd0b9643f62d660c164e1d924f39cf (diff)
downloadop-kernel-dev-6fc0b4a7a73a81e74d0004732df358f4f9975be2.zip
op-kernel-dev-6fc0b4a7a73a81e74d0004732df358f4f9975be2.tar.gz
[IPSEC]: Restrict socket policy loading to CAP_NET_ADMIN.
The interface needs much redesigning if we wish to allow normal users to do this in some way. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ipv6/ipv6_sockglue.c')
-rw-r--r--net/ipv6/ipv6_sockglue.c3
1 files changed, 3 insertions, 0 deletions
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index f3ef4c3..3bc144a 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -504,6 +504,9 @@ done:
break;
case IPV6_IPSEC_POLICY:
case IPV6_XFRM_POLICY:
+ retv = -EPERM;
+ if (!capable(CAP_NET_ADMIN))
+ break;
retv = xfrm_user_policy(sk, optname, optval, optlen);
break;
OpenPOWER on IntegriCloud