netns: bond: allow unprivileged users to control bond device

reduce the permission check of bond device's ioctl.
allow the userns root to control the bond device.

Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index b38c9bf16dec1d1f11704fa8653d2355b1e0395e..22399374b1e11a0d0cf852486d1af3feb474f66e 100644 (file)
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -3612,6 +3612,7 @@ static int bond_do_ioctl(struct net_device *bond_dev, struct ifreq *ifr, int cmd
        struct ifslave k_sinfo;
        struct ifslave __user *u_sinfo = NULL;
        struct mii_ioctl_data *mii = NULL;
+       struct net *net;
        int res = 0;
 
        pr_debug("bond_ioctl: master=%s, cmd=%d\n", bond_dev->name, cmd);
@@ -3678,10 +3679,12 @@ static int bond_do_ioctl(struct net_device *bond_dev, struct ifreq *ifr, int cmd
                break;
        }
 
-       if (!capable(CAP_NET_ADMIN))
+       net = dev_net(bond_dev);
+
+       if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
                return -EPERM;
 
-       slave_dev = dev_get_by_name(dev_net(bond_dev), ifr->ifr_slave);
+       slave_dev = dev_get_by_name(net, ifr->ifr_slave);
 
        pr_debug("slave_dev=%p:\n", slave_dev);