Re: [PATCH] vsock: use ns_capable_noaudit() on socket create

2020-10-26 Thread Jakub Kicinski
On Tue, 27 Oct 2020 07:37:37 +1100 (AEDT) James Morris wrote: > On Fri, 23 Oct 2020, Jeff Vander Stoep wrote: > > > During __vsock_create() CAP_NET_ADMIN is used to determine if the > > vsock_sock->trusted should be set to true. This value is used later > > for determing if a remote connection sho

Re: [PATCH] vsock: use ns_capable_noaudit() on socket create

2020-10-26 Thread James Morris
On Fri, 23 Oct 2020, Jeff Vander Stoep wrote: > During __vsock_create() CAP_NET_ADMIN is used to determine if the > vsock_sock->trusted should be set to true. This value is used later > for determing if a remote connection should be allowed to connect > to a restricted VM. Unfortunately, if the ca