From: Patrick McHardy <kaber@trash.net>
Date: Fri, 28 Mar 2008 03:28:10 +0000 (-0700)
Subject: [LLC]: Restrict LLC sockets to root
X-Git-Tag: v2.6.25-rc9~99^2~30
X-Git-Url: https://err.no/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=3480c63bdf008e9289aab94418f43b9592978fff;p=linux-2.6

[LLC]: Restrict LLC sockets to root

LLC currently allows users to inject raw frames, including IP packets
encapsulated in SNAP. While Linux doesn't handle IP over SNAP, other
systems do. Restrict LLC sockets to root similar to packet sockets.

[ Modified Patrick's patch to use CAP_NEW_RAW --DaveM ]

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
---

diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
index 46cf962f7f..8c50eb430c 100644
--- a/net/llc/af_llc.c
+++ b/net/llc/af_llc.c
@@ -155,6 +155,9 @@ static int llc_ui_create(struct net *net, struct socket *sock, int protocol)
 	struct sock *sk;
 	int rc = -ESOCKTNOSUPPORT;
 
+	if (!capable(CAP_NET_RAW))
+		return -EPERM;
+
 	if (net != &init_net)
 		return -EAFNOSUPPORT;