Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1393295

Re: [Question] Should `CAP_NET_ADMIN` be needed when opening `/dev/ppp`?

Show all headers | View raw

On Sun, May 01, 2016 at 09:38:57PM +0800, Wang Shanker wrote:
> static int ppp_open(struct inode *inode, struct file *file)
> {
> 	/*
> 	 * This could (should?) be enforced by the permissions on /dev/ppp.
> 	 */
> 	if (!capable(CAP_NET_ADMIN))
> 		return -EPERM;
> 	return 0;
> }
> ```
> 
> I wonder why CAP_NET_ADMIN is needed here, rather than leaving it to the
> permission of the device node. If there is no need, I suggest that the
> CAP_NET_ADMIN check be removed.
> 
If this test was removed here, then it'd have to be added again in the
PPPIOCNEWUNIT ioctl, at the very least, because creating a netdevice
should require CAP_NET_ADMIN. Therefore that wouldn't help for your
case.
I don't know why the test was placed in ppp_open() in the first place,
but changing it now would have side effects on user space. So I'd
rather leave the code as is.

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[Question] Should `CAP_NET_ADMIN` be needed when opening `/dev/ppp`? Wang Shanker <shankerwangmiao@gmail.com> - 2016-05-01 15:40 +0200
  Re: [Question] Should `CAP_NET_ADMIN` be needed when opening  `/dev/ppp`? Guillaume Nault <g.nault@alphalink.fr> - 2016-05-03 12:20 +0200
    Re: [Question] Should `CAP_NET_ADMIN` be needed when opening `/dev/ppp`? Richard Weinberger <richard.weinberger@gmail.com> - 2016-05-03 12:40 +0200
      Re: [Question] Should `CAP_NET_ADMIN` be needed when opening `/dev/ppp`? Hannes Frederic Sowa <hannes@stressinduktion.org> - 2016-05-03 13:30 +0200
        Re: [Question] Should `CAP_NET_ADMIN` be needed when opening `/dev/ppp`? 王邈 <shankerwangmiao@gmail.com> - 2016-05-03 15:10 +0200
        Re: [Question] Should `CAP_NET_ADMIN` be needed when opening  `/dev/ppp`? Guillaume Nault <g.nault@alphalink.fr> - 2016-05-03 18:00 +0200
          Re: [Question] Should `CAP_NET_ADMIN` be needed when opening  `/dev/ppp`? Hannes Frederic Sowa <hannes@stressinduktion.org> - 2016-05-03 18:10 +0200
      Re: [Question] Should `CAP_NET_ADMIN` be needed when opening  `/dev/ppp`? Guillaume Nault <g.nault@alphalink.fr> - 2016-05-03 15:50 +0200

csiph-web