You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
70 lines
2.0 KiB
70 lines
2.0 KiB
From: Jeff Mahoney <jeffm@suse.com>
|
|
Subject: [PATCH] mISDN: Add support for group membership check
|
|
References: bnc#564423
|
|
Patch-mainline: Unsubmitted, needs upstream consensus
|
|
|
|
This patch adds a module parameter to allow a group access to the
|
|
mISDN devices. Otherwise, unpriviledged users on systems with ISDN hardware
|
|
have the ability to dial out, potentially causing expensive bills.
|
|
|
|
Based on a different implementation by Patrick Koppen <isdn4linux@koppen.de>
|
|
|
|
Acked-by: Jeff Mahoney <jeffm@suse.com>
|
|
---
|
|
|
|
drivers/isdn/mISDN/core.c | 3 +++
|
|
drivers/isdn/mISDN/core.h | 1 +
|
|
drivers/isdn/mISDN/socket.c | 8 ++++++++
|
|
3 files changed, 12 insertions(+)
|
|
|
|
--- a/drivers/isdn/mISDN/core.c
|
|
+++ b/drivers/isdn/mISDN/core.c
|
|
@@ -21,10 +21,13 @@
|
|
#include "core.h"
|
|
|
|
static u_int debug;
|
|
+u_int misdn_permitted_gid;
|
|
|
|
MODULE_AUTHOR("Karsten Keil");
|
|
MODULE_LICENSE("GPL");
|
|
module_param(debug, uint, S_IRUGO | S_IWUSR);
|
|
+module_param_named(gid, misdn_permitted_gid, uint, 0);
|
|
+MODULE_PARM_DESC(gid, "Unix group for accessing misdn socket (default 0)");
|
|
|
|
static u64 device_ids;
|
|
#define MAX_DEVICE_ID 63
|
|
--- a/drivers/isdn/mISDN/core.h
|
|
+++ b/drivers/isdn/mISDN/core.h
|
|
@@ -17,6 +17,7 @@
|
|
|
|
extern struct mISDNdevice *get_mdevice(u_int);
|
|
extern int get_mdevice_count(void);
|
|
+extern u_int misdn_permitted_gid;
|
|
|
|
/* stack status flag */
|
|
#define mISDN_STACK_ACTION_MASK 0x0000ffff
|
|
--- a/drivers/isdn/mISDN/socket.c
|
|
+++ b/drivers/isdn/mISDN/socket.c
|
|
@@ -608,6 +608,10 @@ data_sock_create(struct net *net, struct
|
|
{
|
|
struct sock *sk;
|
|
|
|
+ if(!capable(CAP_SYS_ADMIN) && (misdn_permitted_gid != current_gid())
|
|
+ && (!in_group_p(misdn_permitted_gid)))
|
|
+ return -EPERM;
|
|
+
|
|
if (sock->type != SOCK_DGRAM)
|
|
return -ESOCKTNOSUPPORT;
|
|
|
|
@@ -690,6 +694,10 @@ base_sock_ioctl(struct socket *sock, uns
|
|
case IMSETDEVNAME:
|
|
{
|
|
struct mISDN_devrename dn;
|
|
+ if(!capable(CAP_SYS_ADMIN)
|
|
+ && (misdn_permitted_gid != current_gid())
|
|
+ && (!in_group_p(misdn_permitted_gid)))
|
|
+ return -EPERM;
|
|
if (copy_from_user(&dn, (void __user *)arg,
|
|
sizeof(dn))) {
|
|
err = -EFAULT;
|