• Marcel Holtmann's avatar
    Bluetooth: Fix HCI User Channel permission check in hci_sock_sendmsg · 1bc5ad16
    Marcel Holtmann authored
    The HCI User Channel is an admin operation which enforces CAP_NET_ADMIN
    when binding the socket. Problem now is that it then requires also
    CAP_NET_RAW when calling into hci_sock_sendmsg. This is not intended
    and just an oversight since general HCI sockets (which do not require
    special permission to bind) and HCI User Channel share the same code
    path here.
    
    Remove the extra CAP_NET_RAW check for HCI User Channel write operation
    since the permission check has already been enforced when binding the
    socket. This also makes it possible to open HCI User Channel from a
    privileged process and then hand the file descriptor to an unprivilged
    process.
    Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
    Tested-by: default avatarSamuel Ortiz <sameo@linux.intel.com>
    Signed-off-by: default avatarJohan Hedberg <johan.hedberg@intel.com>
    1bc5ad16
hci_sock.c 24.9 KB