summaryrefslogtreecommitdiffstats
path: root/net/ipv6
diff options
context:
space:
mode:
authorBalazs Scheidler <bazsi@balabit.hu>2010-10-23 04:48:14 +0000
committerDavid S. Miller <davem@davemloft.net>2010-10-24 16:07:50 -0700
commitb889416b54c90f59276537debd92cb4e84b5f550 (patch)
tree2f4280710cc870e794f270c5978a957ae0c0fce6 /net/ipv6
parent0561cf3dbff1f37c0d374fb1b824ef3a117c85e0 (diff)
tproxy: Add missing CAP_NET_ADMIN check to ipv6 side
IP_TRANSPARENT requires root (more precisely CAP_NET_ADMIN privielges) for IPV6. However as I see right now this check was missed from the IPv6 implementation. Acked-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ipv6')
-rw-r--r--net/ipv6/ipv6_sockglue.c4
1 files changed, 4 insertions, 0 deletions
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index 0553867a317..d1770e061c0 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -343,6 +343,10 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
break;
case IPV6_TRANSPARENT:
+ if (!capable(CAP_NET_ADMIN)) {
+ retv = -EPERM;
+ break;
+ }
if (optlen < sizeof(int))
goto e_inval;
/* we don't have a separate transparent bit for IPV6 we use the one in the IPv4 socket */