[PATCH v1 1/2] Bluetooth: SCO: require CAP_NET_BIND_SERVICE to bind

[Luiz Augusto von Dentz <luiz.dentz@gmail.com>]

From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

SCO sockets have no PSM or port namespace: binding one simply reserves
the ability to accept any incoming eSCO/SCO connection on the adapter.
That is equivalent to listening on a well-known service, which L2CAP
already restricts to CAP_NET_BIND_SERVICE in
l2cap_validate_bredr_psm()/l2cap_validate_le_psm().

Apply the same restriction to sco_sock_bind() so unprivileged processes
can no longer hijack incoming SCO links.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
---
 net/bluetooth/sco.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index 3d4362a09df4..e4c26551e513 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -667,6 +667,13 @@ static int sco_sock_bind(struct socket *sock, struct sockaddr_unsized *addr,
 
 	BT_DBG("sk %p %pMR", sk, &sa->sco_bdaddr);
 
+	/* Binding a SCO socket reserves the ability to accept any incoming
+	 * eSCO/SCO connection on the adapter, so restrict it in the same way
+	 * L2CAP restricts well-known PSMs.
+	 */
+	if (!capable(CAP_NET_BIND_SERVICE))
+		return -EACCES;
+
 	lock_sock(sk);
 
 	if (sk->sk_state != BT_OPEN) {
-- 
2.54.0