Hi, Tom Herbert wrote: > Hi, > > In ipv6_sockglue.c I noticed: > > /* hop-by-hop / destination options are privileged option */ > retv = -EPERM; > if (optname != IPV6_RTHDR && !ns_capable(net->user_ns, CAP_NET_RAW)) > break; > > Can anyone provide that rationale as to why these are privileged ops?
It is better to disallow by default for security. FreeBSD does this in the same way. We may have sysctl bitmaps, of course. --yoshfuji > > Thanks, > Tom > -- Hideaki Yoshifuji <hideaki.yoshif...@miraclelinux.com> Technical Division, MIRACLE LINUX CORPORATION
