[PATCH net-next] net: align SO_RCVMARK required privileges with SO_MARK

* [PATCH net-next] net: align SO_RCVMARK required privileges with SO_MARK
@ 2022-05-04  9:54 Eyal Birger
  2022-05-05 22:51 ` Jakub Kicinski
  2022-05-06  1:20 ` patchwork-bot+netdevbpf
  0 siblings, 2 replies; 3+ messages in thread
From: Eyal Birger @ 2022-05-04  9:54 UTC (permalink / raw)
  To: davem, edumazet, kuba, pabeni, asml.silence
  Cc: aahringo, weiwan, fw, yangbo.lu, tglx, dsahern, lnx.erin, mkl,
	netdev, Eyal Birger

The commit referenced in the "Fixes" tag added the SO_RCVMARK socket
option for receiving the skb mark in the ancillary data.

Since this is a new capability, and exposes admin configured details
regarding the underlying network setup to sockets, let's align the
needed capabilities with those of SO_MARK.

Fixes: 6fd1d51cfa25 ("net: SO_RCVMARK socket option for SO_MARK with recvmsg()")
Signed-off-by: Eyal Birger <eyal.birger@gmail.com>
---
 net/core/sock.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/net/core/sock.c b/net/core/sock.c
index be20a1af20e5..6b287eb5427b 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -1315,6 +1315,12 @@ int sock_setsockopt(struct socket *sock, int level, int optname,
 		__sock_set_mark(sk, val);
 		break;
 	case SO_RCVMARK:
+		if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_RAW) &&
+		    !ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN)) {
+			ret = -EPERM;
+			break;
+		}
+
 		sock_valbool_flag(sk, SOCK_RCVMARK, valbool);
 		break;
 
-- 
2.34.1


^ permalink raw reply related	[flat|nested] 3+ messages in thread