tree fd9a11a09bf038336429f33dc092333aa745edb1
parent aaff23a95aea5f000895f50d90e91f1e2f727002
author Florian Westphal <fwestphal@astaro.com> 1262968284 +0100
committer Patrick McHardy <kaber@trash.net> 1262968284 +0100

netfilter: ebtables: enforce CAP_NET_ADMIN

normal users are currently allowed to set/modify ebtables rules.
Restrict it to processes with CAP_NET_ADMIN.

Note that this cannot be reproduced with unmodified ebtables binary
because it uses SOCK_RAW.

Signed-off-by: Florian Westphal <fwestphal@astaro.com>
Cc: stable@kernel.org
Signed-off-by: Patrick McHardy <kaber@trash.net>