Subject: Re: [PATCH] netfilter: ebtables: enforce CAP_NET_ADMIN

From: Patrick McHardy <[email-masked]>
Date: Thu, 07 Jan 2010 18:37:39 +0100

Florian Westphal wrote:
> normal users are currently allowed to set/modify ebtables rules.
> Restrict it to processes with CAP_NET_ADMIN.
> 
> Signed-off-by: Florian Westphal <[email-masked]>
> ---
>  Note that this cannot be reproduced with
>  unmodified ebtables binary because it uses SOCK_RAW.

Unbelievable that this went unnoticed for so long. Applied and
queued for -stable, thanks a lot Florian.