From: Jakub Kicinski Date: Mon, 31 Jan 2022 23:33:57 +0000 (-0800) Subject: net: allow SO_MARK with CAP_NET_RAW via cmsg X-Git-Tag: v5.18-rc1~136^2~472 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=91f0d8a4813a9a50404b7c48a43fdc46fc77d235;p=thirdparty%2Fkernel%2Flinux.git net: allow SO_MARK with CAP_NET_RAW via cmsg There's not reason SO_MARK would be allowed via setsockopt() and not via cmsg, let's keep the two consistent. See commit 079925cce1d0 ("net: allow SO_MARK with CAP_NET_RAW") for justification why NET_RAW -> SO_MARK is safe. Reviewed-by: Maciej Żenczykowski Reviewed-by: David Ahern Link: https://lore.kernel.org/r/20220131233357.52964-1-kuba@kernel.org Signed-off-by: Jakub Kicinski --- diff --git a/net/core/sock.c b/net/core/sock.c index d6804685f17f0..09d31a7dc68f8 100644 --- a/net/core/sock.c +++ b/net/core/sock.c @@ -2625,7 +2625,8 @@ int __sock_cmsg_send(struct sock *sk, struct msghdr *msg, struct cmsghdr *cmsg, switch (cmsg->cmsg_type) { case SO_MARK: - if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN)) + if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_RAW) && + !ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN)) return -EPERM; if (cmsg->cmsg_len != CMSG_LEN(sizeof(u32))) return -EINVAL;