[PATCH v2 08/10] netlink: require CAP_NET_ADMIN for socket changes

[Julian Orth]

The calling process must have CAP_NET_ADMIN in the user namespace of the
transit namespace.
---
 src/netlink.c        | 11 +++++++++++
 src/uapi/wireguard.h |  4 ++++
 2 files changed, 15 insertions(+)

diff --git a/src/netlink.c b/src/netlink.c
index f74c23a..e7f8c69 100644
--- a/src/netlink.c
+++ b/src/netlink.c
@@ -304,6 +304,13 @@ static int get_device_done(struct netlink_callback *cb)
 	return 0;
 }
 
+static int test_net_capable(struct net *net)
+{
+	if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
+		return -EPERM;
+	return 0;
+}
+
 static int set_socket(struct wireguard_device *wg, struct nlattr **attrs)
 {
 	struct wireguard_peer *peer;
@@ -329,6 +336,10 @@ static int set_socket(struct wireguard_device *wg, struct nlattr **attrs)
 	else
 		port = wg->incoming_port;
 
+	ret = test_net_capable(net ? : wg->transit_net);
+	if (ret)
+		goto out;
+
 	if (wg->incoming_port == port && (!net || wg->transit_net == net))
 		goto out;
 
diff --git a/src/uapi/wireguard.h b/src/uapi/wireguard.h
index 21bf92e..40d800f 100644
--- a/src/uapi/wireguard.h
+++ b/src/uapi/wireguard.h
@@ -77,6 +77,10 @@
  * must be provided. All other top-level items are optional. At most one of
  * WGDEVICE_A_TRANSIT_NETNS_PID and WGDEVICE_A_TRANSIT_NETNS_FD may be provided.
  *
+ * If WGDEVICE_A_TRANSIT_NETNS_PID/FD and/or WGDEVICE_A_LISTEN_PORT are
+ * provided, then the calling process must have CAP_NET_ADMIN the transit
+ * namespace.
+ *
  *
  *    WGDEVICE_A_IFINDEX: NLA_U32
  *    WGDEVICE_A_IFNAME: NLA_NUL_STRING, maxlen IFNAMESIZ - 1
-- 
2.18.0