Re: [Question] Should `CAP_NET_ADMIN` be needed when opening `/dev/ppp`?

2016-05-03 Thread Hannes Frederic Sowa
On 03.05.2016 17:51, Guillaume Nault wrote: > On Tue, May 03, 2016 at 01:23:34PM +0200, Hannes Frederic Sowa wrote: >> On Tue, May 3, 2016, at 12:35, Richard Weinberger wrote: >>> On Tue, May 3, 2016 at 12:12 PM, Guillaume Nault >>> wrote: On Sun, May 01, 2016 at 09:38:57PM +0800, Wang Shanke

Re: [Question] Should `CAP_NET_ADMIN` be needed when opening `/dev/ppp`?

2016-05-03 Thread Guillaume Nault
On Tue, May 03, 2016 at 01:23:34PM +0200, Hannes Frederic Sowa wrote: > On Tue, May 3, 2016, at 12:35, Richard Weinberger wrote: > > On Tue, May 3, 2016 at 12:12 PM, Guillaume Nault > > wrote: > > > On Sun, May 01, 2016 at 09:38:57PM +0800, Wang Shanker wrote: > > >> static int ppp_open(struct ino

Re: [Question] Should `CAP_NET_ADMIN` be needed when opening `/dev/ppp`?

2016-05-03 Thread Guillaume Nault
On Tue, May 03, 2016 at 12:35:12PM +0200, Richard Weinberger wrote: > On Tue, May 3, 2016 at 12:12 PM, Guillaume Nault wrote: > > On Sun, May 01, 2016 at 09:38:57PM +0800, Wang Shanker wrote: > >> static int ppp_open(struct inode *inode, struct file *file) > >> { > >> /* > >>* This c

Re: [Question] Should `CAP_NET_ADMIN` be needed when opening `/dev/ppp`?

2016-05-03 Thread 王邈
> 在 2016年5月3日，下午7:23，Hannes Frederic Sowa 写道： > > On Tue, May 3, 2016, at 12:35, Richard Weinberger wrote: >> On Tue, May 3, 2016 at 12:12 PM, Guillaume Nault >> wrote: >>> On Sun, May 01, 2016 at 09:38:57PM +0800, Wang Shanker wrote: static int ppp_open(struct inode *inode, struct file *f

Re: [Question] Should `CAP_NET_ADMIN` be needed when opening `/dev/ppp`?

2016-05-03 Thread Hannes Frederic Sowa
On Tue, May 3, 2016, at 12:35, Richard Weinberger wrote: > On Tue, May 3, 2016 at 12:12 PM, Guillaume Nault > wrote: > > On Sun, May 01, 2016 at 09:38:57PM +0800, Wang Shanker wrote: > >> static int ppp_open(struct inode *inode, struct file *file) > >> { > >> /* > >>* This could (sho

Re: [Question] Should `CAP_NET_ADMIN` be needed when opening `/dev/ppp`?

2016-05-03 Thread Richard Weinberger
On Tue, May 3, 2016 at 12:12 PM, Guillaume Nault wrote: > On Sun, May 01, 2016 at 09:38:57PM +0800, Wang Shanker wrote: >> static int ppp_open(struct inode *inode, struct file *file) >> { >> /* >>* This could (should?) be enforced by the permissions on /dev/ppp. >>*/ >>

Re: [Question] Should `CAP_NET_ADMIN` be needed when opening `/dev/ppp`?

2016-05-03 Thread Guillaume Nault
On Sun, May 01, 2016 at 09:38:57PM +0800, Wang Shanker wrote: > static int ppp_open(struct inode *inode, struct file *file) > { > /* >* This could (should?) be enforced by the permissions on /dev/ppp. >*/ > if (!capable(CAP_NET_ADMIN)) > return -EPERM; >

[Question] Should `CAP_NET_ADMIN` be needed when opening `/dev/ppp`?

2016-05-01 Thread Wang Shanker
Hi, all. I’ve recently met some problems when trying to create a pppoe network link inside a unprivileged container. There is a uid namespace which maps root inside to a normal user outside. There is also a separate