From: Guillaume Nault <g.nault@alphalink.fr>
To: Wang Shanker <shankerwangmiao@gmail.com>
Cc: netdev@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [Question] Should `CAP_NET_ADMIN` be needed when opening `/dev/ppp`?
Date: Tue, 3 May 2016 12:12:40 +0200 [thread overview]
Message-ID: <20160503101240.GA1304@alphalink.fr> (raw)
In-Reply-To: <2BEB0C68-EBC6-4A8F-A751-DE8F4A2C9D2C@gmail.com>
On Sun, May 01, 2016 at 09:38:57PM +0800, Wang Shanker wrote:
> static int ppp_open(struct inode *inode, struct file *file)
> {
> /*
> * This could (should?) be enforced by the permissions on /dev/ppp.
> */
> if (!capable(CAP_NET_ADMIN))
> return -EPERM;
> return 0;
> }
> ```
>
> I wonder why CAP_NET_ADMIN is needed here, rather than leaving it to the
> permission of the device node. If there is no need, I suggest that the
> CAP_NET_ADMIN check be removed.
>
If this test was removed here, then it'd have to be added again in the
PPPIOCNEWUNIT ioctl, at the very least, because creating a netdevice
should require CAP_NET_ADMIN. Therefore that wouldn't help for your
case.
I don't know why the test was placed in ppp_open() in the first place,
but changing it now would have side effects on user space. So I'd
rather leave the code as is.
next prev parent reply other threads:[~2016-05-03 10:18 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-05-01 13:38 Wang Shanker
2016-05-03 10:12 ` Guillaume Nault [this message]
2016-05-03 10:35 ` Richard Weinberger
2016-05-03 11:23 ` Hannes Frederic Sowa
2016-05-03 13:08 ` 王邈
2016-05-03 15:51 ` Guillaume Nault
2016-05-03 16:01 ` Hannes Frederic Sowa
2016-05-03 13:40 ` Guillaume Nault
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20160503101240.GA1304@alphalink.fr \
--to=g.nault@alphalink.fr \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=shankerwangmiao@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
Powered by JetHome