Creating a tun or tap device requires CAP_NET_ADMIN. So does attaching to a device unless the caller is its owner or a member of its group. Convert both checks to NET_RIGHT_TUN. SIOCGSKNS and TUNGETDEVNETNS return a file descriptor for a network namespace. They keep the plain capability check. No functional change. Signed-off-by: Josef Bacik --- drivers/net/tun.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/tun.c b/drivers/net/tun.c index dcec7311e601..0a2f864a253e 100644 --- a/drivers/net/tun.c +++ b/drivers/net/tun.c @@ -524,7 +524,7 @@ static inline bool tun_permitted(struct tun_struct *tun) (!gid_valid(tun->group) || in_egroup_p(tun->group))) return true; - return ns_capable(net->user_ns, CAP_NET_ADMIN); + return net_may(net, NET_RIGHT_TUN); } static void tun_set_real_num_queues(struct tun_struct *tun) @@ -2924,7 +2924,7 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr) int queues = ifr->ifr_flags & IFF_MULTI_QUEUE ? MAX_TAP_QUEUES : 1; - if (!ns_capable(net->user_ns, CAP_NET_ADMIN)) + if (!net_may(net, NET_RIGHT_TUN)) return -EPERM; err = security_tun_dev_create(); if (err < 0) -- 2.55.0