On Wed, 2014-02-19 at 13:08 -0500, Richard Guy Briggs wrote: > Register a netlink per-protocol bind fuction for audit to check userspace > process capabilities before allowing a multicast group connection. > > Signed-off-by: Richard Guy Briggs <r...@redhat.com> > --- > kernel/audit.c | 10 ++++++++++ > 1 files changed, 10 insertions(+), 0 deletions(-) > > diff --git a/kernel/audit.c b/kernel/audit.c > index b5b2f72..f2d2d61 100644 > --- a/kernel/audit.c > +++ b/kernel/audit.c > @@ -1050,10 +1050,20 @@ static void audit_receive(struct sk_buff *skb) > mutex_unlock(&audit_cmd_mutex); > } > > +/* Run custom bind function on netlink socket group connect or bind > requests. */ > +static int audit_bind(int group) > +{ > + if (!capable(CAP_AUDIT_READ))
Not a great idea to use CAP_AUDIT_READ before you define it in patch4 > + return -EPERM; > + > + return 0; > +} > + > static int __net_init audit_net_init(struct net *net) > { > struct netlink_kernel_cfg cfg = { > .input = audit_receive, > + .bind = audit_bind, > }; > > struct audit_net *aunet = net_generic(net, audit_net_id); -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/