From: Haggai Eran <haggaie-VPRAkNaXOzVWk0Htik3J/w@public.gmane.org>
To: ira.weiny-ral2JQCrhuEAvxtiuMwx3w@public.gmane.org,
dledford-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org
Cc: linux-rdma-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
Subject: Re: [PATCH] IB/sa: Restrict SA Netlink to admin users
Date: Mon, 10 Aug 2015 09:11:08 +0300 [thread overview]
Message-ID: <55C8407C.6060103@mellanox.com> (raw)
In-Reply-To: <1438895310-6087-1-git-send-email-ira.weiny-ral2JQCrhuEAvxtiuMwx3w@public.gmane.org>
On 07/08/2015 00:08, ira.weiny-ral2JQCrhuEAvxtiuMwx3w@public.gmane.org wrote:
> @@ -754,6 +764,12 @@ static int ib_nl_handle_resolve_resp(struct sk_buff *skb,
> int found = 0;
> int ret;
>
> + if (!ns_capable(sock_net(skb->sk)->user_ns, CAP_NET_ADMIN)) {
> + pr_warn_ratelimited("SA netlink: invalid perm for response: `%s'.\n",
> + current->comm);
> + return -EPERM;
> + }
> +
> spin_lock_irqsave(&ib_nl_request_lock, flags);
> list_for_each_entry(query, &ib_nl_request_list, list) {
> /*
Maybe I'm missing something, but I thought you would want to check the
capability with init_user_ns as the target, since the SA queries will
affect all namespaces, not just the one that sent the response.
Haggai
--
To unsubscribe from this list: send the line "unsubscribe linux-rdma" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
next prev parent reply other threads:[~2015-08-10 6:11 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-08-06 21:08 [PATCH] IB/sa: Restrict SA Netlink to admin users ira.weiny-ral2JQCrhuEAvxtiuMwx3w
[not found] ` <1438895310-6087-1-git-send-email-ira.weiny-ral2JQCrhuEAvxtiuMwx3w@public.gmane.org>
2015-08-10 6:11 ` Haggai Eran [this message]
[not found] ` <55C8407C.6060103-VPRAkNaXOzVWk0Htik3J/w@public.gmane.org>
2015-08-10 21:58 ` ira.weiny
[not found] ` <20150810215829.GA12260-W4f6Xiosr+yv7QzWx2u06xL4W9x8LtSr@public.gmane.org>
2015-08-11 5:38 ` Jason Gunthorpe
[not found] ` <20150811053810.GA13314-ePGOBjL8dl3ta4EC/59zMFaTQe2KTcn/@public.gmane.org>
2015-08-11 11:27 ` Wan, Kaike
[not found] ` <3F128C9216C9B84BB6ED23EF16290AFB18540085-8k97q/ur5Z1cIJlls4ac1rfspsVTdybXVpNB7YpNyf8@public.gmane.org>
2015-08-11 16:27 ` ira.weiny
2015-08-11 16:26 ` ira.weiny
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=55C8407C.6060103@mellanox.com \
--to=haggaie-vpraknaxozvwk0htik3j/w@public.gmane.org \
--cc=dledford-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org \
--cc=ira.weiny-ral2JQCrhuEAvxtiuMwx3w@public.gmane.org \
--cc=linux-rdma-u79uwXL29TY76Z2rM5mHXA@public.gmane.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).