projects / linux.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 5978a9b) | patch
[NETFILTER] nfnetlink: only load subsystems if CAP_NET_ADMIN is set
authorHarald Welte <laforge@netfilter.org>
Wed, 9 Nov 2005 21:02:16 +0000 (13:02 -0800)
committerDavid S. Miller <davem@davemloft.net>
Wed, 9 Nov 2005 21:02:16 +0000 (13:02 -0800)
commited77de9fc69076e6e7c85edf7c1b70650f53121a
treeeb75bc1a632003f97d50920023e7802f5e2ae169tree | snapshot
parent5978a9b82c55b82a1087bd86e0ae8b00f94d0d0bcommit | diff
[NETFILTER] nfnetlink: only load subsystems if CAP_NET_ADMIN is set

Without this patch, any user can cause nfnetlink subsystems to be
autoloaded.  Those subsystems however could add significant processing
overhead to packet processing, and would refuse any configuration messages
from non-CAP_NET_ADMIN processes anyway.

This patch follows a suggestion from Patrick McHardy.

Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/netfilter/nfnetlink.c diff | blob | history
ep93xx device tree rework repo: git://git.maquefel.me/linux.git