git.openpandora.org / pandora-kernel.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: e3f94f6) | patch
netfilter: ebtables: enforce CAP_NET_ADMIN
authorFlorian Westphal <fwestphal@astaro.com>
Fri, 8 Jan 2010 16:31:24 +0000 (17:31 +0100)
committerGreg Kroah-Hartman <gregkh@suse.de>
Mon, 18 Jan 2010 18:33:47 +0000 (10:33 -0800)
commitf21c582a940198ef810e7744c9f91cdafd1a6ed5
treeae218ce717fda67fc3df067927c1d4ca58118a9dtree | snapshot
parente3f94f64a91768da5b136b22dc5faa2447ec2ac8commit | diff
netfilter: ebtables: enforce CAP_NET_ADMIN

commit dce766af541f6605fa9889892c0280bab31c66ab upstream.

normal users are currently allowed to set/modify ebtables rules.
Restrict it to processes with CAP_NET_ADMIN.

Note that this cannot be reproduced with unmodified ebtables binary
because it uses SOCK_RAW.

Signed-off-by: Florian Westphal <fwestphal@astaro.com>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
net/bridge/netfilter/ebtables.c diff | blob | history
Pandora Kernel Repository