From: Balazs Scheidler <bazsi@balabit.hu>
Date: Sat, 23 Oct 2010 04:48:14 +0000 (+0000)
Subject: tproxy: Add missing CAP_NET_ADMIN check to ipv6 side
X-Git-Tag: upstream/snapshot3+hdmi~12461^2~182
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=b889416b54c90f59276537debd92cb4e84b5f550;p=platform%2Fadaptation%2Frenesas_rcar%2Frenesas_kernel.git

tproxy: Add missing CAP_NET_ADMIN check to ipv6 side

IP_TRANSPARENT requires root (more precisely CAP_NET_ADMIN privielges)
for IPV6.

However as I see right now this check was missed from the IPv6
implementation.

Acked-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>

Signed-off-by: David S. Miller <davem@davemloft.net>
---

diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index 0553867..d1770e0 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -343,6 +343,10 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
 		break;
 
 	case IPV6_TRANSPARENT:
+		if (!capable(CAP_NET_ADMIN)) {
+			retv = -EPERM;
+			break;
+		}
 		if (optlen < sizeof(int))
 			goto e_inval;
 		/* we don't have a separate transparent bit for IPV6 we use the one in the IPv4 socket */