From: Gao feng <gaofeng@cn•fujitsu.com>
To: Matt Helsley <matthltc@linux•vnet.ibm.com>
Cc: davem@davemloft•net, amwang@redhat•com, netdev@vger•kernel.org,
containers@lists•linux-foundation.org, ebiederm@xmission•com,
pablo@netfilter•org
Subject: Re: [PATCH net-next 3/4] netns: bridge: allow unprivileged users add/delete mdb entry
Date: Fri, 01 Feb 2013 11:59:03 +0800 [thread overview]
Message-ID: <510B3D87.6050908@cn.fujitsu.com> (raw)
In-Reply-To: <20130201034629.GE8400@us.ibm.com>
On 2013/02/01 11:46, Matt Helsley wrote:
> On Fri, Feb 01, 2013 at 10:30:59AM +0800, Gao feng wrote:
>> since the mdb table is belong to bridge device,and the
>> bridge device can only be seen in one netns.
>> So it's safe to allow unprivileged user which is the
>> creator of userns and netns to modify the mdb table.
>>
>> Signed-off-by: Gao feng <gaofeng@cn•fujitsu.com>
>> ---
>> net/bridge/br_mdb.c | 3 ---
>> 1 file changed, 3 deletions(-)
>>
>> diff --git a/net/bridge/br_mdb.c b/net/bridge/br_mdb.c
>> index acc9f4c..38991e0 100644
>> --- a/net/bridge/br_mdb.c
>> +++ b/net/bridge/br_mdb.c
>> @@ -272,9 +272,6 @@ static int br_mdb_parse(struct sk_buff *skb, struct nlmsghdr *nlh,
>> struct net_device *dev;
>> int err;
>>
>> - if (!capable(CAP_NET_ADMIN))
>> - return -EPERM;
>> -
>
> I'm wondering why this doesn't follow the:
>
> ...
> - if (!capable(CAP_NET_ADMIN))
> + if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
>
> pattern like the rest of the changes you provided. Perhaps I'm
> neglecting something but it looks wrong to remove the CAP_NET_ADMIN
> check entirely.
>
rtnetlink_rcv_msg has done this job,in commit dfc47ef8639facd77210e74be831943c2fdd9c74
Eric change capable to ns_capable in rtnetlink_rcv_msg and Push capable(CAP_NET_ADMIN)
into the rtnl methods.So we only need to do is remove this capable in br_mdb_parse.
Thanks!
next prev parent reply other threads:[~2013-02-01 3:58 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-02-01 2:30 [PATCH net-next 1/4]netns: fdb: allow unprivileged users to add/del fdb entries Gao feng
2013-02-01 2:30 ` [PATCH net-next 2/4] netns: ebtable: allow unprivileged users to operate ebtables Gao feng
[not found] ` <1359685860-29636-2-git-send-email-gaofeng-BthXqXjhjHXQFUHtdCDX3A@public.gmane.org>
2013-02-04 18:12 ` David Miller
[not found] ` <1359685860-29636-1-git-send-email-gaofeng-BthXqXjhjHXQFUHtdCDX3A@public.gmane.org>
2013-02-01 2:30 ` [PATCH net-next 3/4] netns: bridge: allow unprivileged users add/delete mdb entry Gao feng
2013-02-01 3:46 ` Matt Helsley
2013-02-01 3:59 ` Gao feng [this message]
[not found] ` <510B3D87.6050908-BthXqXjhjHXQFUHtdCDX3A@public.gmane.org>
2013-02-01 4:11 ` Matt Helsley
[not found] ` <1359685860-29636-3-git-send-email-gaofeng-BthXqXjhjHXQFUHtdCDX3A@public.gmane.org>
2013-02-04 18:13 ` David Miller
2013-02-04 18:12 ` [PATCH net-next 1/4]netns: fdb: allow unprivileged users to add/del fdb entries David Miller
2013-02-01 2:31 ` [PATCH net-next 4/4] netns: bond: allow unprivileged users to control bond device Gao feng
[not found] ` <1359685860-29636-4-git-send-email-gaofeng-BthXqXjhjHXQFUHtdCDX3A@public.gmane.org>
2013-02-04 18:13 ` David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=510B3D87.6050908@cn.fujitsu.com \
--to=gaofeng@cn$(echo .)fujitsu.com \
--cc=amwang@redhat$(echo .)com \
--cc=containers@lists$(echo .)linux-foundation.org \
--cc=davem@davemloft$(echo .)net \
--cc=ebiederm@xmission$(echo .)com \
--cc=matthltc@linux$(echo .)vnet.ibm.com \
--cc=netdev@vger$(echo .)kernel.org \
--cc=pablo@netfilter$(echo .)org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox