[PATCH RFC v3 77/90] net: use net_may() in the configuration ioctls

[Josef Bacik <josef@toxicpanda.com>]

The ioctls that predate rtnetlink have their own CAP_NET_ADMIN checks.
Convert them:

  NET_RIGHT_LINK   the device ioctls in dev_ioctl(), and SIOCSIFFLAGS in
                   devinet_ioctl()
  NET_RIGHT_ADDR   the address ioctls in devinet_ioctl(), and
                   addrconf_add_ifaddr() and addrconf_del_ifaddr()
  NET_RIGHT_ROUTE  SIOCADDRT and SIOCDELRT for IPv4 and IPv6, and SIOCSARP
                   and SIOCDARP

No functional change.

Signed-off-by: Josef Bacik <josef@toxicpanda.com>
---
 net/core/dev_ioctl.c    | 4 ++--
 net/ipv4/arp.c          | 2 +-
 net/ipv4/devinet.c      | 4 ++--
 net/ipv4/fib_frontend.c | 2 +-
 net/ipv6/addrconf.c     | 4 ++--
 net/ipv6/route.c        | 2 +-
 6 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/net/core/dev_ioctl.c b/net/core/dev_ioctl.c
index f6029f60c1dc..caec8909b0c2 100644
--- a/net/core/dev_ioctl.c
+++ b/net/core/dev_ioctl.c
@@ -757,7 +757,7 @@ int dev_ioctl(struct net *net, unsigned int cmd, struct ifreq *ifr,
 	case SIOCGMIIREG:
 	case SIOCSIFNAME:
 		dev_load(net, ifr->ifr_name);
-		if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
+		if (!net_may(net, NET_RIGHT_LINK))
 			return -EPERM;
 
 		rtnl_net_lock(net);
@@ -799,7 +799,7 @@ int dev_ioctl(struct net *net, unsigned int cmd, struct ifreq *ifr,
 	case SIOCBONDSETHWADDR:
 	case SIOCBONDCHANGEACTIVE:
 	case SIOCSHWTSTAMP:
-		if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
+		if (!net_may(net, NET_RIGHT_LINK))
 			return -EPERM;
 		fallthrough;
 	case SIOCBONDSLAVEINFOQUERY:
diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
index 1ca4ced280ae..934eead1dc51 100644
--- a/net/ipv4/arp.c
+++ b/net/ipv4/arp.c
@@ -1285,7 +1285,7 @@ int arp_ioctl(struct net *net, unsigned int cmd, void __user *arg)
 	switch (cmd) {
 	case SIOCDARP:
 	case SIOCSARP:
-		if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
+		if (!net_may(net, NET_RIGHT_ROUTE))
 			return -EPERM;
 		fallthrough;
 	case SIOCGARP:
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index 1e9d988849c9..ec57948ffbb3 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -1088,7 +1088,7 @@ int devinet_ioctl(struct net *net, unsigned int cmd, struct ifreq *ifr)
 
 	case SIOCSIFFLAGS:
 		ret = -EPERM;
-		if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
+		if (!net_may(net, NET_RIGHT_LINK))
 			goto out;
 		break;
 	case SIOCSIFADDR:	/* Set interface address (and family) */
@@ -1096,7 +1096,7 @@ int devinet_ioctl(struct net *net, unsigned int cmd, struct ifreq *ifr)
 	case SIOCSIFDSTADDR:	/* Set the destination address */
 	case SIOCSIFNETMASK: 	/* Set the netmask for the interface */
 		ret = -EPERM;
-		if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
+		if (!net_may(net, NET_RIGHT_ADDR))
 			goto out;
 		ret = -EINVAL;
 		if (sin->sin_family != AF_INET)
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index 8c123b111b3d..67d1eb7f8b7a 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -651,7 +651,7 @@ int ip_rt_ioctl(struct net *net, unsigned int cmd, struct rtentry *rt)
 	switch (cmd) {
 	case SIOCADDRT:		/* Add a route */
 	case SIOCDELRT:		/* Delete a route */
-		if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
+		if (!net_may(net, NET_RIGHT_ROUTE))
 			return -EPERM;
 
 		rtnl_net_lock(net);
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index c8c0dd04982d..3699e5410992 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -3185,7 +3185,7 @@ int addrconf_add_ifaddr(struct net *net, void __user *arg)
 	struct in6_ifreq ireq;
 	int err;
 
-	if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
+	if (!net_may(net, NET_RIGHT_ADDR))
 		return -EPERM;
 
 	if (copy_from_user(&ireq, arg, sizeof(struct in6_ifreq)))
@@ -3212,7 +3212,7 @@ int addrconf_del_ifaddr(struct net *net, void __user *arg)
 	struct in6_ifreq ireq;
 	int err;
 
-	if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
+	if (!net_may(net, NET_RIGHT_ADDR))
 		return -EPERM;
 
 	if (copy_from_user(&ireq, arg, sizeof(struct in6_ifreq)))
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 616b86f89f63..f458a3cae13a 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -4578,7 +4578,7 @@ int ipv6_route_ioctl(struct net *net, unsigned int cmd, struct in6_rtmsg *rtmsg)
 
 	if (cmd != SIOCADDRT && cmd != SIOCDELRT)
 		return -EINVAL;
-	if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
+	if (!net_may(net, NET_RIGHT_ROUTE))
 		return -EPERM;
 
 	rtmsg_to_fib6_config(net, rtmsg, &cfg);

-- 
2.55.0