net: Use ns_capable_noaudit() when determining net sysctl permissions
Subsystems (2)
PATCH 1/1 net: Use ns_capable_noaudit() when determining net sysctl permissions
From: Tyler Hicks <[email protected]>
The capability check should not be audited since it is only being used to determine the inode permissions. A failed check does not indicate a violation of security policy but, when an LSM is enabled, a denial audit message was being generated.
The denial audit message caused confusion for some application authors because root-running Go applications always triggered the denial. To prevent this confusion, the capability check in net_ctl_permissions() is switched to the noaudit variant.
[dtor: reapplied after e79c6a4fc923 ("net: make net namespace sysctls belong to container's owner") accidentally reverted the change.]
--- net/sysctl_net.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/sysctl_net.c +1 -1
@@ -44,7 +44,7 @@ static int net_ctl_permissions(struct ctl_table_header *head, struct net *net = container_of(head->set, struct net, sysctls);/* Allow network administrator to have same access as root. */ -if (ns_capable (net->user_ns,CAP_NET_ADMIN )) { +if (ns_capable_noaudit (net->user_ns,CAP_NET_ADMIN )) {int mode = (table->mode >>6 ) &7 ;return (mode <<6 ) | (mode <<3 ) | mode; }
Signature · 5 lines
2.8.0.rc3.226.g39d4020 -- Dmitry
From: Dmitry Torokhov <[email protected]>
Date: Fri, 30 Sep 2016 15:24:31 -0700
Quoted 12 lines
From: Tyler Hicks <[email protected]>
The capability check should not be audited since it is only being used to determine the inode permissions. A failed check does not indicate a violation of security policy but, when an LSM is enabled, a denial audit message was being generated.
The denial audit message caused confusion for some application authors because root-running Go applications always triggered the denial. To prevent this confusion, the capability check in
net_ctl_permissions()is switched to the noaudit variant.
Quoted 8 lines
Signed-off-by Tyler Hicks <[email protected]>Acked-by Serge E. Hallyn <[email protected]>Signed-off-by James Morris <[email protected]>[dtor: reapplied after
e79c6a4fc923("net: make net namespace sysctls belong to container's owner") accidentally reverted the change.]Signed-off-by Dmitry Torokhov <[email protected]>
Applied, but please be clear in the future what tree a patch is targetting, in this case 'net-next'.
You can indicate this in the Subject line "[PATCH net-next]".
Quoted 24 lines · David Miller
From: Dmitry Torokhov <[email protected]>
Date: Fri, 30 Sep 2016 15:24:31 -0700Quoted 12 lines
From: Tyler Hicks <[email protected]>
The capability check should not be audited since it is only being used to determine the inode permissions. A failed check does not indicate a violation of security policy but, when an LSM is enabled, a denial audit message was being generated.
The denial audit message caused confusion for some application authors because root-running Go applications always triggered the denial. To prevent this confusion, the capability check in
net_ctl_permissions()is switched to the noaudit variant.Quoted 8 lines
Signed-off-by Tyler Hicks <[email protected]>Acked-by Serge E. Hallyn <[email protected]>Signed-off-by James Morris <[email protected]>[dtor: reapplied after
e79c6a4fc923("net: make net namespace sysctls belong to container's owner") accidentally reverted the change.]Signed-off-by Dmitry Torokhov <[email protected]>
Quoted 4 lines
Applied, but please be clear in the future what tree a patch is targetting, in this case 'net-next'.
You can indicate this in the Subject line "[PATCH net-next]".
Sorry, will do next time.
Thanks.
Signature · 1 line
Dmitry