Skip to content

Commit

Permalink
net: allow CAP_NET_RAW to setsockopt SO_PRIORITY
Browse files Browse the repository at this point in the history
CAP_NET_ADMIN is and should continue to be about configuring the
system as a whole, not about configuring per-socket or per-packet
parameters.
Sending and receiving raw packets is what CAP_NET_RAW is all about.

It can already send packets with any VLAN tag, and any IPv4 TOS
mark, and any IPv6 TCLASS mark, simply by virtue of building
such a raw packet.  Not to mention using any protocol and source/
/destination ip address/port tuple.

These are the fields that networking gear uses to prioritize packets.

Hence, a CAP_NET_RAW process is already capable of affecting traffic
prioritization after it hits the wire.  This change makes it capable
of affecting traffic prioritization even in the host at the nic and
before that in the queueing disciplines (provided skb->priority is
actually being used for prioritization, and not the TOS/TCLASS field)

Hence it makes sense to allow a CAP_NET_RAW process to set the
priority of sockets and thus packets it sends.

Signed-off-by: Maciej Żenczykowski <maze@google.com>
Link: https://lore.kernel.org/r/20211123203702.193221-1-zenczykowski@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  • Loading branch information
zenczykowski authored and kuba-moo committed Nov 25, 2021
1 parent 0898ca6 commit a1b519b
Showing 1 changed file with 1 addition and 0 deletions.
1 change: 1 addition & 0 deletions net/core/sock.c
Original file line number Diff line number Diff line change
Expand Up @@ -1135,6 +1135,7 @@ int sock_setsockopt(struct socket *sock, int level, int optname,

case SO_PRIORITY:
if ((val >= 0 && val <= 6) ||
ns_capable(sock_net(sk)->user_ns, CAP_NET_RAW) ||
ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))
sk->sk_priority = val;
else
Expand Down

0 comments on commit a1b519b

Please sign in to comment.