PERFORCE change 79539 for review

[Robert Watson]

http://perforce.freebsd.org/chv.cgi?CH=79539

Change 79539 by rwatson at rwatson_paprika on 2005/07/04 11:43:20

	Throughout netinet, convert new suser() checks to CAP_NET_ADMIN
	checks, where the checks correspond to administrative activities in
	the network stack.

Affected files ...

.. //depot/projects/trustedbsd/sebsd/sys/netinet/ip_carp.c#2 edit
.. //depot/projects/trustedbsd/sebsd/sys/netinet/ip_fw2.c#13 edit
.. //depot/projects/trustedbsd/sebsd/sys/netinet/ip_mroute.c#12 edit
.. //depot/projects/trustedbsd/sebsd/sys/netinet/raw_ip.c#15 edit

Differences ...

==== //depot/projects/trustedbsd/sebsd/sys/netinet/ip_carp.c#2 (text+ko) ====

@@ -33,6 +33,7 @@
 
 #include <sys/types.h>
 #include <sys/param.h>
+#include <sys/capability.h>
 #include <sys/systm.h>
 #include <sys/conf.h>
 #include <sys/kernel.h>
@@ -1815,7 +1816,7 @@
 		break;
 
 	case SIOCSVH:
-		if ((error = suser(curthread)) != 0)
+		if ((error = cap_check(curthread, CAP_NET_ADMIN)) != 0)
 			break;
 		if ((error = copyin(ifr->ifr_data, &carpr, sizeof carpr)))
 			break;
@@ -1890,7 +1891,7 @@
 		carpr.carpr_vhid = sc->sc_vhid;
 		carpr.carpr_advbase = sc->sc_advbase;
 		carpr.carpr_advskew = sc->sc_advskew;
-		if (suser(curthread) == 0)
+		if (cap_check(curthread, CAP_NET_ADMIN) == 0)
 			bcopy(sc->sc_key, carpr.carpr_key,
 			    sizeof(carpr.carpr_key));
 		error = copyout(&carpr, ifr->ifr_data, sizeof(carpr));

==== //depot/projects/trustedbsd/sebsd/sys/netinet/ip_fw2.c#13 (text+ko) ====

@@ -44,6 +44,7 @@
 #endif
 
 #include <sys/param.h>
+#include <sys/capability.h>
 #include <sys/systm.h>
 #include <sys/condvar.h>
 #include <sys/malloc.h>
@@ -3586,7 +3587,7 @@
 	struct ip_fw *buf, *rule;
 	u_int32_t rulenum[2];
 
-	error = suser(sopt->sopt_td);
+	error = cap_check(sopt->sopt_td, CAP_NET_ADMIN);
 	if (error)
 		return (error);
 

==== //depot/projects/trustedbsd/sebsd/sys/netinet/ip_mroute.c#12 (text+ko) ====

@@ -531,7 +531,7 @@
      * Typically, only root can create the raw socket in order to execute
      * this ioctl method, however the request might be coming from a prison
      */
-    error = suser(curthread);
+    error = cap_check(curthread, CAP_NET_ADMIN);
     if (error)
 	return (error);
     switch (cmd) {

==== //depot/projects/trustedbsd/sebsd/sys/netinet/raw_ip.c#15 (text+ko) ====

@@ -364,7 +364,7 @@
 		case IP_FW_GET:
 		case IP_FW_TABLE_GETSIZE:
 		case IP_FW_TABLE_LIST:
-			error = suser(curthread);
+			error = cap_check(curthread, CAP_NET_ADMIN);
 			if (error != 0)
 				return (error);
 			if (ip_fw_ctl_ptr != NULL)
@@ -374,7 +374,7 @@
 			break;
 
 		case IP_DUMMYNET_GET:
-			error = suser(curthread);
+			error = cap_check(curthread, CAP_NET_ADMIN);
 			if (error != 0)
 				return (error);
 			if (ip_dn_ctl_ptr != NULL)
@@ -395,7 +395,7 @@
 		case MRT_API_CONFIG:
 		case MRT_ADD_BW_UPCALL:
 		case MRT_DEL_BW_UPCALL:
-			error = suser(curthread);
+			error = cap_check(curthread, CAP_NET_ADMIN);
 			if (error != 0)
 				return (error);
 			error = ip_mrouter_get ? ip_mrouter_get(so, sopt) :
@@ -429,7 +429,7 @@
 		case IP_FW_TABLE_ADD:
 		case IP_FW_TABLE_DEL:
 		case IP_FW_TABLE_FLUSH:
-			error = suser(curthread);
+			error = cap_check(curthread, CAP_NET_ADMIN);
 			if (error != 0)
 				return (error);
 			if (ip_fw_ctl_ptr != NULL)
@@ -441,7 +441,7 @@
 		case IP_DUMMYNET_CONFIGURE:
 		case IP_DUMMYNET_DEL:
 		case IP_DUMMYNET_FLUSH:
-			error = suser(curthread);
+			error = cap_check(curthread, CAP_NET_ADMIN);
 			if (error != 0)
 				return (error);
 			if (ip_dn_ctl_ptr != NULL)
@@ -451,14 +451,14 @@
 			break ;
 
 		case IP_RSVP_ON:
-			error = suser(curthread);
+			error = cap_check(curthread, CAP_NET_ADMIN);
 			if (error != 0)
 				return (error);
 			error = ip_rsvp_init(so);
 			break;
 
 		case IP_RSVP_OFF:
-			error = suser(curthread);
+			error = cap_check(curthread, CAP_NET_ADMIN);
 			if (error != 0)
 				return (error);
 			error = ip_rsvp_done();
@@ -466,7 +466,7 @@
 
 		case IP_RSVP_VIF_ON:
 		case IP_RSVP_VIF_OFF:
-			error = suser(curthread);
+			error = cap_check(curthread, CAP_NET_ADMIN);
 			if (error != 0)
 				return (error);
 			error = ip_rsvp_vif ?
@@ -485,7 +485,7 @@
 		case MRT_API_CONFIG:
 		case MRT_ADD_BW_UPCALL:
 		case MRT_DEL_BW_UPCALL:
-			error = suser(curthread);
+			error = cap_check(curthread, CAP_NET_ADMIN);
 			if (error != 0)
 				return (error);
 			error = ip_mrouter_set ? ip_mrouter_set(so, sopt) :
To Unsubscribe: send mail to majordomo at trustedbsd.org
with "unsubscribe trustedbsd-cvs" in the body of the message