Revert "drop_monitor: Require 'CAP_SYS_ADMIN' when joining "events" group"

This reverts commit e844a9309f which is
commit e03781879a0d524ce3126678d50a80484a513c4b upstream.

It breaks the Android kernel abi and can be brought back in the future
in an abi-safe way if it is really needed.

Bug: 161946584
Change-Id: Iecbd6b6537bd4cd2d178d0afbdc7557e521429c5
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
This commit is contained in:
Greg Kroah-Hartman
2023-12-18 19:07:26 +00:00
parent e4dd66fb02
commit ae04f2701b
3 changed files with 1 additions and 8 deletions

View File

@@ -12,12 +12,10 @@
/**
* struct genl_multicast_group - generic netlink multicast group
* @name: name of the multicast group, names are per-family
* @cap_sys_admin: whether %CAP_SYS_ADMIN is required for binding
*/
struct genl_multicast_group {
char name[GENL_NAMSIZ];
u8 flags;
u8 cap_sys_admin:1;
};
struct genl_ops;

View File

@@ -183,7 +183,7 @@ out:
}
static const struct genl_multicast_group dropmon_mcgrps[] = {
{ .name = "events", .cap_sys_admin = 1 },
{ .name = "events", },
};
static void send_dm_alert(struct work_struct *work)
@@ -1616,13 +1616,11 @@ static const struct genl_small_ops dropmon_ops[] = {
.cmd = NET_DM_CMD_START,
.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
.doit = net_dm_cmd_trace,
.flags = GENL_ADMIN_PERM,
},
{
.cmd = NET_DM_CMD_STOP,
.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
.doit = net_dm_cmd_trace,
.flags = GENL_ADMIN_PERM,
},
{
.cmd = NET_DM_CMD_CONFIG_GET,

View File

@@ -1387,9 +1387,6 @@ static int genl_bind(struct net *net, int group)
if ((grp->flags & GENL_UNS_ADMIN_PERM) &&
!ns_capable(net->user_ns, CAP_NET_ADMIN))
ret = -EPERM;
if (grp->cap_sys_admin &&
!ns_capable(net->user_ns, CAP_SYS_ADMIN))
ret = -EPERM;
break;
}