X-Git-Url: https://err.no/cgi-bin/gitweb.cgi?a=blobdiff_plain;f=net%2Fipv4%2Fip_sockglue.c;h=ff4bd067b39727c50e4aafdd1cbd49ea0dfd849b;hb=8aaf226a8eaa0823c4f3c58d5207004ff6e3e758;hp=fc7c481d0d79378981841ff6989bcaebc0b14f23;hpb=cc14cf46da215a9df1c0a4388763a68769ef9e53;p=linux-2.6

diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index fc7c481d0d..ff4bd067b3 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -848,6 +848,9 @@ mc_msf_out:
  
 		case IP_IPSEC_POLICY:
 		case IP_XFRM_POLICY:
+			err = -EPERM;
+			if (!capable(CAP_NET_ADMIN))
+				break;
 			err = xfrm_user_policy(sk, optname, optval, optlen);
 			break;