#include <asm/uaccess.h>
#include <linux/mroute6.h>
+#ifdef CONFIG_ANDROID_PARANOID_NETWORK
+#include <linux/android_aid.h>
+#endif
+
MODULE_AUTHOR("Cast of dozens");
MODULE_DESCRIPTION("IPv6 protocol stack for Linux");
MODULE_LICENSE("GPL");
return (struct ipv6_pinfo *)(((u8 *)sk) + offset);
}
+#ifdef CONFIG_ANDROID_PARANOID_NETWORK
+static inline int current_has_network(void)
+{
+ return (!current_euid() || in_egroup_p(AID_INET) ||
+ in_egroup_p(AID_NET_RAW));
+}
+static inline int current_has_cap(struct net *net, int cap)
+{
+ if (cap == CAP_NET_RAW && in_egroup_p(AID_NET_RAW))
+ return 1;
+ return ns_capable(net->user_ns, cap);
+}
+# else
+static inline int current_has_network(void)
+{
+ return 1;
+}
+static inline int current_has_cap(struct net *net, int cap)
+{
+ return ns_capable(net->user_ns, cap);
+}
+#endif
+
static int inet6_create(struct net *net, struct socket *sock, int protocol,
int kern)
{
int try_loading_module = 0;
int err;
+ if (protocol < 0 || protocol >= IPPROTO_MAX)
+ return -EINVAL;
+
+ if (!current_has_network())
+ return -EACCES;
+
/* Look for the requested type/protocol pair. */
lookup_protocol:
err = -ESOCKTNOSUPPORT;
err = -EPERM;
if (sock->type == SOCK_RAW && !kern &&
- !ns_capable(net->user_ns, CAP_NET_RAW))
+ !current_has_cap(net, CAP_NET_RAW))
goto out_rcu_unlock;
sock->ops = answer->ops;