korg/linux
0
0
Fork 0
mirror of https://mirrors.bfsu.edu.cn/git/linux.git synced 2024-11-26 05:34:13 +08:00
Code Issues Packages Projects Releases Wiki Activity

[NET]: Disable netfilter sockopts when not in the initial network namespace

Browse Source 
Until we support multiple network namespaces with netfilter only allow
netfilter configuration in the initial network namespace.

Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Eric W. Biederman 2007-09-12 13:58:02 +02:00 committed by David S. Miller
parent d8a5ec6727
commit c48dad7ecd
1 changed files with 7 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
net/netfilter/nf_sockopt.c
View File

@ -69,6 +69,9 @@ static int nf_sockopt(struct sock *sk, int pf, int val,
struct nf_sockopt_ops *ops; struct nf_sockopt_ops *ops;
int ret; int ret;
if (sk->sk_net != &init_net)
return -ENOPROTOOPT;
if (mutex_lock_interruptible(&nf_sockopt_mutex) != 0) if (mutex_lock_interruptible(&nf_sockopt_mutex) != 0)
return -EINTR; return -EINTR;
@ -125,6 +128,10 @@ static int compat_nf_sockopt(struct sock *sk, int pf, int val,
struct nf_sockopt_ops *ops; struct nf_sockopt_ops *ops;
int ret; int ret;
if (sk->sk_net != &init_net)
return -ENOPROTOOPT;
if (mutex_lock_interruptible(&nf_sockopt_mutex) != 0) if (mutex_lock_interruptible(&nf_sockopt_mutex) != 0)
return -EINTR; return -EINTR;