X-Git-Url: http://pileus.org/git/?a=blobdiff_plain;f=net%2Fsysctl_net.c;h=9bc6db04be3ea7cd998f41187ff40b19baa9c920;hb=1eb99af52c4bc705f4042f37f255975acfc738f2;hp=e3a6e37cd1c536cc93d5caa850219e4104bb646b;hpb=23910c50cced8f35d53e4f8ea0cc09ad58d286af;p=~andy%2Flinux

diff --git a/net/sysctl_net.c b/net/sysctl_net.c
index e3a6e37cd1c..9bc6db04be3 100644
--- a/net/sysctl_net.c
+++ b/net/sysctl_net.c
@@ -38,15 +38,24 @@ static int is_seen(struct ctl_table_set *set)
 }
 
 /* Return standard mode bits for table entry. */
-static int net_ctl_permissions(struct ctl_table_root *root,
-			       struct nsproxy *nsproxy,
+static int net_ctl_permissions(struct ctl_table_header *head,
 			       struct ctl_table *table)
 {
+	struct net *net = container_of(head->set, struct net, sysctls);
+	kuid_t root_uid = make_kuid(net->user_ns, 0);
+	kgid_t root_gid = make_kgid(net->user_ns, 0);
+
 	/* Allow network administrator to have same access as root. */
-	if (capable(CAP_NET_ADMIN)) {
+	if (ns_capable(net->user_ns, CAP_NET_ADMIN) ||
+	    uid_eq(root_uid, current_uid())) {
 		int mode = (table->mode >> 6) & 7;
 		return (mode << 6) | (mode << 3) | mode;
 	}
+	/* Allow netns root group to have the same access as the root group */
+	if (gid_eq(root_gid, current_gid())) {
+		int mode = (table->mode >> 3) & 7;
+		return (mode << 3) | mode;
+	}
 	return table->mode;
 }