net: align SO_RCVMARK required privileges with SO_MARK

The commit referenced in the "Fixes" tag added the SO_RCVMARK socket
option for receiving the skb mark in the ancillary data.

Since this is a new capability, and exposes admin configured details
regarding the underlying network setup to sockets, let's align the
needed capabilities with those of SO_MARK.

Fixes: 6fd1d51cfa25 ("net: SO_RCVMARK socket option for SO_MARK with recvmsg()")
Signed-off-by: Eyal Birger <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Jakub Kicinski <[email protected]>

diff --git a/net/core/sock.c b/net/core/sock.c
index be20a1af20e5eafc5e87e5a8b78d4773c07629ac..6b287eb5427b32865d25fc22122fefeff3a4ccf5 100644 (file)
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -1315,6 +1315,12 @@ set_sndbuf:
                __sock_set_mark(sk, val);
                break;
        case SO_RCVMARK:
+               if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_RAW) &&
+                   !ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN)) {
+                       ret = -EPERM;
+                       break;
+               }
+
                sock_valbool_flag(sk, SOCK_RCVMARK, valbool);
                break;