Subject: Re: IPv6 extension header privileges

From: YOSHIFUJI Hideaki <[email-masked]>
Date: Fri, 27 May 2016 12:37:47 +0900

Hi,

Tom Herbert wrote:
> Hi,
> 
> In ipv6_sockglue.c I noticed:
> 
> /* hop-by-hop / destination options are privileged option */
> retv = -EPERM;
> if (optname != IPV6_RTHDR && !ns_capable(net->user_ns, CAP_NET_RAW))
>            break;
> 
> Can anyone provide that rationale as to why these are privileged ops?

It is better to disallow by default for security.
FreeBSD does this in the same way.
We may have sysctl bitmaps, of course.

--yoshfuji

> Thanks,
> Tom

-- 
Hideaki Yoshifuji <[email-masked]>
Technical Division, MIRACLE LINUX CORPORATION