Commit 1f86123b authored by Eyal Birger's avatar Eyal Birger Committed by Jakub Kicinski
Browse files

net: align SO_RCVMARK required privileges with SO_MARK 



The commit referenced in the "Fixes" tag added the SO_RCVMARK socket
option for receiving the skb mark in the ancillary data.

Since this is a new capability, and exposes admin configured details
regarding the underlying network setup to sockets, let's align the
needed capabilities with those of SO_MARK.

Fixes: 6fd1d51c ("net: SO_RCVMARK socket option for SO_MARK with recvmsg()")
Signed-off-by: default avatarEyal Birger <eyal.birger@gmail.com>
Link: https://lore.kernel.org/r/20220504095459.2663513-1-eyal.birger@gmail.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent c4a67a21

net/core/sock.c

+6 −0
Original line number Diff line number Diff line
@@ -1315,6 +1315,12 @@ int sock_setsockopt(struct socket *sock, int level, int optname, 
		__sock_set_mark(sk, val);

		break;

	case SO_RCVMARK:

		if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_RAW) &&

		    !ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN)) {

			ret = -EPERM;

			break;

		}



		sock_valbool_flag(sk, SOCK_RCVMARK, valbool);

		break;