diff options
| author | Richard Guy Briggs <rgb@redhat.com> | 2014-04-23 03:31:54 +0200 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2014-04-23 03:42:26 +0200 |
| commit | 4f520900522fd596e336c07e9aafd5b7a9564235 (patch) | |
| tree | 324137d33d9fe83adba3b0a96026f645fe7b12f1 /net/netlink/af_netlink.h | |
| parent | netlink: simplify nfnetlink_bind (diff) | |
| download | linux-4f520900522fd596e336c07e9aafd5b7a9564235.tar.xz linux-4f520900522fd596e336c07e9aafd5b7a9564235.zip | |
netlink: have netlink per-protocol bind function return an error code.
Have the netlink per-protocol optional bind function return an int error code
rather than void to signal a failure.
This will enable netlink protocols to perform extra checks including
capabilities and permissions verifications when updating memberships in
multicast groups.
In netlink_bind() and netlink_setsockopt() the call to the per-protocol bind
function was moved above the multicast group update to prevent any access to
the multicast socket groups before checking with the per-protocol bind
function. This will enable the per-protocol bind function to be used to check
permissions which could be denied before making them available, and to avoid
the messy job of undoing the addition should the per-protocol bind function
fail.
The netfilter subsystem seems to be the only one currently using the
per-protocol bind function.
Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/netlink/af_netlink.h')
| -rw-r--r-- | net/netlink/af_netlink.h | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/net/netlink/af_netlink.h b/net/netlink/af_netlink.h index ed13a790b00e..0b59d441f5b6 100644 --- a/net/netlink/af_netlink.h +++ b/net/netlink/af_netlink.h @@ -38,7 +38,8 @@ struct netlink_sock { struct mutex *cb_mutex; struct mutex cb_def_mutex; void (*netlink_rcv)(struct sk_buff *skb); - void (*netlink_bind)(int group); + int (*netlink_bind)(int group); + void (*netlink_unbind)(int group); struct module *module; #ifdef CONFIG_NETLINK_MMAP struct mutex pg_vec_lock; @@ -74,7 +75,8 @@ struct netlink_table { unsigned int groups; struct mutex *cb_mutex; struct module *module; - void (*bind)(int group); + int (*bind)(int group); + void (*unbind)(int group); bool (*compare)(struct net *net, struct sock *sock); int registered; }; |