From 47d700de4fb9fd40022d240c52cf736ec5c06c0c Mon Sep 17 00:00:00 2001
From: Kees Cook <keescook@chromium.org>
Date: Mon, 25 Feb 2013 21:32:25 +0000
Subject: [PATCH] --- yaml --- r: 360774 b: refs/heads/master c:
 e70ab977991964a5a7ad1182799451d067e62669 h: refs/heads/master v: v3

---
 [refs]                            | 2 +-
 trunk/drivers/connector/cn_proc.c | 8 ++++++++
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/[refs] b/[refs]
index b6e1add0c917..79e7f9664be0 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 114a6f8b52163c0232fbcd7f3808ff04dc61a9b5
+refs/heads/master: e70ab977991964a5a7ad1182799451d067e62669
diff --git a/trunk/drivers/connector/cn_proc.c b/trunk/drivers/connector/cn_proc.c
index fce2000eec31..1110478dd0fd 100644
--- a/trunk/drivers/connector/cn_proc.c
+++ b/trunk/drivers/connector/cn_proc.c
@@ -313,6 +313,12 @@ static void cn_proc_mcast_ctl(struct cn_msg *msg,
 	    (task_active_pid_ns(current) != &init_pid_ns))
 		return;
 
+	/* Can only change if privileged. */
+	if (!capable(CAP_NET_ADMIN)) {
+		err = EPERM;
+		goto out;
+	}
+
 	mc_op = (enum proc_cn_mcast_op *)msg->data;
 	switch (*mc_op) {
 	case PROC_CN_MCAST_LISTEN:
@@ -325,6 +331,8 @@ static void cn_proc_mcast_ctl(struct cn_msg *msg,
 		err = EINVAL;
 		break;
 	}
+
+out:
 	cn_proc_ack(err, msg->seq, msg->ack);
 }