Re: [PATCH] vsock: use ns_capable_noaudit() on socket create

2020-10-26 Thread Jakub Kicinski
On Tue, 27 Oct 2020 07:37:37 +1100 (AEDT) James Morris wrote: > On Fri, 23 Oct 2020, Jeff Vander Stoep wrote: > > > During __vsock_create() CAP_NET_ADMIN is used to determine if the > > vsock_sock->trusted should be set to true. This value is used later > > for determing if a remote connection

Re: [PATCH] vsock: use ns_capable_noaudit() on socket create

2020-10-26 Thread James Morris
On Fri, 23 Oct 2020, Jeff Vander Stoep wrote: > During __vsock_create() CAP_NET_ADMIN is used to determine if the > vsock_sock->trusted should be set to true. This value is used later > for determing if a remote connection should be allowed to connect > to a restricted VM. Unfortunately, if the

[PATCH] vsock: use ns_capable_noaudit() on socket create

2020-10-23 Thread Jeff Vander Stoep
During __vsock_create() CAP_NET_ADMIN is used to determine if the vsock_sock->trusted should be set to true. This value is used later for determing if a remote connection should be allowed to connect to a restricted VM. Unfortunately, if the caller doesn't have CAP_NET_ADMIN, an audit message such