Allow group ownership of TUN/TAP devices
Subsystems (2)
PATCH 1/1 Allow group ownership of TUN/TAP devices
I recieved from Guido Guenther the patch below to the TUN/TAP driver which allows group ownerships to be effective.
It seems reasonable to me.
Quoted 11 lines
the attached patches allow tun ownership by group. We found this useful since we can then spawn tapX devices on system boot (via
/etc/network/interfaces) which logged on users can then use for their virtual machines.The first patch is for the kernel, the second one for the tunctl. They shouldn't change existing behaviour and we introduced a new syscall for the group setting. The user now is allowed to send packages if either his euid or his egid matches the one specified via tunctl (via -u or -g respecitvely). If both gid and uid are set via tunctl, both have to match. In case you find these useful, please apply.
Signature · 10 lines
Work email - jdike at linux dot intel dot com From: Guido Guenther <[email protected]> Date: Fri, 25 May 2007 11:10:27 +0200 Subject: [PATCH] allow tun ownership by group --- drivers/net/tun.c | 15 +++++++++++++-- include/linux/if_tun.h | 2 ++ 2 files changed, 15 insertions(+), 2 deletions(-)
drivers/net/tun.c +13 -2
@@ -432,6 +432,7 @@ static void tun_setup(struct net_device *dev)init_waitqueue_head (&tun->read_wait); tun->owner =-1 ; + tun->group =-1 ;SET_MODULE_OWNER (dev); dev->open = tun_net_open;
@@ -467,8 +468,11 @@ static int tun_set_iff(struct file *file, struct ifreq *ifr)return -EBUSY ;/* Check permissions */ -if (tun->owner !=-1 && - current->euid != tun->owner && !capable (CAP_NET_ADMIN )) +if (((tun->owner !=-1 && + current->euid != tun->owner) || + (tun->group !=-1 && + current->egid != tun->group)) && + !capable (CAP_NET_ADMIN ))return -EPERM ; }else if (__dev_get_by_name (ifr->ifr_name))
@@ -610,6 +614,13 @@ static int tun_chr_ioctl(struct inode *inode, struct file *file,DBG (KERN_INFO "%s: owner set to %d\n" , tun->dev->name, tun->owner);break ; +case TUNSETGROUP : +/* Set group of the device */ + tun->group= (gid_t ) arg; + +DBG (KERN_INFO "%s: group set to %d\n" , tun->dev->name, tun->group); +break ; +case TUNSETLINK :/* Only allow setting the type when the interface is down */ if (tun->dev->flags &IFF_UP ) {
include/linux/if_tun.h +2 -0
@@ -36,6 +36,7 @@ struct tun_struct {unsigned long flags;int attached;uid_t owner; +gid_t group;wait_queue_head_t read_wait;struct sk_buff_head readq;
@@ -78,6 +79,7 @@ struct tun_struct {#define TUNSETPERSIST _IOW('T', 203, int)#define TUNSETOWNER _IOW('T', 204, int)#define TUNSETLINK _IOW('T', 205, int) +#define TUNSETGROUP _IOW('T', 206, int)/* TUNSETIFF ifr flags */ #define IFF_TUN 0x0001
Signature · 1 line
1.5.1.4
Quoted 4 lines · Jeff Dike
I recieved from Guido Guenther the patch below to the TUN/TAP driver which allows group ownerships to be effective.
It seems reasonable to me.
Looks good to me too. We'll add to my tree. In the mean time I don't mind if one of net drv maintainers pushes it upstream.
Thanx
Max