About this list Date view Thread view Subject view Author view Attachment view

From: Ulrich Weber (mail_at_nibbler.net)
Date: Wed 16 Mar 2005 - 17:58:23 GMT


Hi all,

because my vserver provider was unable to disable CAP_NET_RAW (all other
customers want to use ping) I did some reseach on the topic.
Attached please find a workaround patch to use ping without SUID (I got
the inspiration from VXC_RAW_ICMP in vServer 1.9.4).

I have no vserver installed, so I tested the attached patch in an
user-mode-linux instance where it worked.
Hope it works for vserver with CAP_NET_RAW disabled too.

Is it possible to add this patch to the next stable release ?

Best regards
 Ulrich

diff -Nru linux-2.4.27.org/net/ipv4/af_inet.c linux-2.4.27/net/ipv4/af_inet.c
--- af_inet.c 2005-03-16 18:39:54.000000000 +0100
+++ af_inet.c 2005-03-16 18:39:43.000000000 +0100
@@ -352,7 +352,7 @@
 
        if (!answer)
                goto free_and_badtype;
- if (answer->capability > 0 && !capable(answer->capability))
+ if ((protocol != IPPROTO_ICMP) && (answer->capability > 0) &&
!capable(answer->capability))
                goto free_and_badperm;
        if (!protocol)
                goto free_and_noproto;

_______________________________________________
Vserver mailing list
Vserver_at_list.linux-vserver.org
http://list.linux-vserver.org/mailman/listinfo/vserver


About this list Date view Thread view Subject view Author view Attachment view
[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Wed 16 Mar 2005 - 18:02:52 GMT by hypermail 2.1.3