[PATCH RFC v3 80/90] net: use net_may() for the net sysctls

[Josef Bacik]

net_ctl_permissions() gives a task with CAP_NET_ADMIN over the owner of a
network namespace the same access to the sysctls of that namespace as
their owner has. The handler of the IPv4 forwarding sysctls checks the
capability a second time on a write. Convert both checks to
NET_RIGHT_SYSCTL.

No functional change.

Signed-off-by: Josef Bacik <josef@xxxxxxxxxxxxxx>
---
 net/ipv4/devinet.c | 2 +-
 net/sysctl_net.c   | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index ec57948ffbb3..44baea38bec4 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -2602,7 +2602,7 @@ static int devinet_sysctl_forward(const struct ctl_table *ctl, int write,
 	int val = *valp;
 	int ret;
 
-	if (write && !ns_capable(net->user_ns, CAP_NET_ADMIN))
+	if (write && !net_may(net, NET_RIGHT_SYSCTL))
 		return -EPERM;
 
 	ret = proc_dointvec(ctl, write, buffer, lenp, ppos);
diff --git a/net/sysctl_net.c b/net/sysctl_net.c
index e190a639eef2..1a79b8a3674d 100644
--- a/net/sysctl_net.c
+++ b/net/sysctl_net.c
@@ -45,7 +45,7 @@ static int net_ctl_permissions(struct ctl_table_header *head,
 	struct net *net = container_of(head->set, struct net, sysctls);
 
 	/* Allow network administrator to have same access as root. */
-	if (ns_capable_noaudit(net->user_ns, CAP_NET_ADMIN)) {
+	if (net_may_noaudit(net, NET_RIGHT_SYSCTL)) {
 		int mode = (table->mode >> 6) & 7;
 		return (mode << 6) | (mode << 3) | mode;
 	}

-- 
2.55.0