diff options
| author | J. Bruce Fields <[email protected]> | 2009-03-16 22:34:20 +0000 |
|---|---|---|
| committer | J. Bruce Fields <[email protected]> | 2009-03-17 18:55:55 +0000 |
| commit | 76a67ec6fb79ff3570dcb5342142c16098299911 (patch) | |
| tree | 45bfd454d59ce611a103d6b63fff08a5cb5d2194 /net/unix/af_unix.c | |
| parent | NFSD: provide encode routine for OP_OPENATTR (diff) | |
| download | kernel-76a67ec6fb79ff3570dcb5342142c16098299911.tar.gz kernel-76a67ec6fb79ff3570dcb5342142c16098299911.zip | |
nfsd: nfsd should drop CAP_MKNOD for non-root
Since creating a device node is normally an operation requiring special
privilege, Igor Zhbanov points out that it is surprising (to say the
least) that a client can, for example, create a device node on a
filesystem exported with root_squash.
So, make sure CAP_MKNOD is among the capabilities dropped when an nfsd
thread handles a request from a non-root user.
Reported-by: Igor Zhbanov <[email protected]>
Cc: [email protected]
Signed-off-by: J. Bruce Fields <[email protected]>
Diffstat (limited to 'net/unix/af_unix.c')
0 files changed, 0 insertions, 0 deletions