• Eric W. Biederman's avatar
    sysfs: Restrict mounting sysfs · 7dc5dbc8
    Eric W. Biederman authored
    Don't allow mounting sysfs unless the caller has CAP_SYS_ADMIN rights
    over the net namespace.  The principle here is if you create or have
    capabilities over it you can mount it, otherwise you get to live with
    what other people have mounted.
    
    Instead of testing this with a straight forward ns_capable call,
    perform this check the long and torturous way with kobject helpers,
    this keeps direct knowledge of namespaces out of sysfs, and preserves
    the existing sysfs abstractions.
    Acked-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: default avatar"Eric W. Biederman" <ebiederm@xmission.com>
    7dc5dbc8
net-sysfs.c 31.1 KB