[PATCH] virtio: nsm: require CAP_SYS_ADMIN for raw messages

[Yousef Alhouseen]

NSM_IOCTL_RAW is documented as CAP_SYS_ADMIN-only.

/dev/nsm is mode 0666, but the ioctl handler did not check that capability.

Reject unprivileged raw messages before sending them to the device.

Signed-off-by: Yousef Alhouseen <alhouseenyousef@xxxxxxxxx>
---
 drivers/misc/nsm.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/misc/nsm.c b/drivers/misc/nsm.c
index e39ff0071..8153edff3 100644
--- a/drivers/misc/nsm.c
+++ b/drivers/misc/nsm.c
@@ -9,6 +9,7 @@
  * space can use to issue these commands.
  */
 
+#include <linux/capability.h>
 #include <linux/file.h>
 #include <linux/fs.h>
 #include <linux/interrupt.h>
@@ -361,6 +362,9 @@ static long nsm_dev_ioctl(struct file *file, unsigned int cmd,
 	if (cmd != NSM_IOCTL_RAW)
 		return -EINVAL;
 
+	if (!capable(CAP_SYS_ADMIN))
+		return -EPERM;
+
 	if (_IOC_SIZE(cmd) != sizeof(raw))
 		return -EINVAL;
 
-- 
2.54.0