Repository files (latest commit first)

Filename	Latest commit message	Latest commit date
Vincent Bernat d59577b6ff sk-filter: Add ability to lock a socket filter program ... While a privileged program can open a raw socket, attach some restrictive filter and drop its privileges (or send the socket to an unprivileged program through some Unix socket), the filter can still be removed or modified by the unprivileged program. This commit adds a socket option to lock the filter (SO_LOCK_FILTER) preventing any modification of a socket filter program. This is similar to OpenBSD BIOCLOCK ioctl on bpf sockets, except even root is not allowed change/drop the filter. The state of the lock can be read with getsockopt(). No error is triggered if the state is not changed. -EPERM is returned when a user tries to remove the lock or to change/remove the filter while the lock is active. The check is done directly in sk_attach_filter() and sk_detach_filter() and does not affect only setsockopt() syscall. Signed-off-by: Vincent Bernat <bernat@luffy.cx> Signed-off-by: David S. Miller <davem@davemloft.net>		2013-01-17 03:21:25 -05:00
..
9p
bluetooth	Bluetooth: trivial: Change NO_FCS_RECV to RECV_NO_FCS	2012-12-03 16:00:01 -02:00
caif	caif-hsi: Remove use of module parameters	2012-06-25 16:44:12 -07:00
irda	various: Fix spelling of "registered" in comments.	2012-11-19 14:29:46 +01:00
iucv
netfilter	netfilter: nf_conntrack: fix BUG_ON while removing nf_conntrack with netns	2013-01-12 14:12:36 +01:00
netns	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2013-01-15 15:05:59 -05:00
nfc	NFC: Export nfc_hci_sak_to_protocol()	2012-11-19 23:56:59 +01:00
phonet	net: remove my future former mail address	2012-06-17 16:29:38 -07:00
sctp	sctp: Add RCU protection to assoc->transport_addr_list	2012-12-07 14:15:04 -05:00
tc_act
act_api.h	pkt_sched: namespace aware act_mirred	2013-01-14 15:09:36 -05:00
addrconf.h	ipv6: Make ipv6_is_mld() inline and use it from ip6_mc_input().	2013-01-13 20:17:14 -05:00
af_ieee802154.h
af_rxrpc.h
af_unix.h	unix: Remove unused field from unix_sock	2012-10-21 20:37:06 -04:00
ah.h
arp.h	net: Dont use ifindices in hash fns	2012-08-09 16:18:06 -07:00
atmclip.h
ax25.h	userns: Convert net/ax25 to use kuid_t where appropriate	2012-08-14 21:49:42 -07:00
ax88796.h
cfg80211-wext.h
cfg80211.h	net: use ETHTOOL_FWVERS_LEN instead of ETHTOOL_BUSINFO_LEN for fw_ver strings	2013-01-06 21:06:31 -08:00
checksum.h	net: core: add function for incremental IPv6 pseudo header checksum updates	2012-08-30 03:00:16 +02:00
cipso_ipv4.h	cipso: handle CIPSO options correctly when NetLabel is disabled	2012-06-01 14:18:29 -04:00
cls_cgroup.h	net: Update args to dummy sock_update_classid().	2012-10-26 05:07:00 -04:00
codel.h	codel: refine one condition to avoid a nul rec_inv_sqrt	2012-08-10 16:52:54 -07:00
compat.h
datalink.h
dcbevent.h
dcbnl.h
dn.h
dn_dev.h
dn_fib.h
dn_neigh.h
dn_nsp.h
dn_route.h	decnet: Use neighbours privately in dn_route struct.	2012-07-05 01:12:14 -07:00
dsa.h
dsfield.h	ipv6: Optimize ipv6_change_dsfield().	2013-01-09 23:59:53 -08:00
dst.h	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2012-08-22 14:21:38 -07:00
dst_ops.h	net: Fix warnings in dst_ops.h	2012-07-19 10:43:03 -07:00
esp.h
ethoc.h
fib_rules.h	ipv4: Elide fib_validate_source() completely when possible.	2012-06-29 01:36:36 -07:00
flow.h	ipv4: Add FLOWI_FLAG_KNOWN_NH	2012-10-08 17:42:36 -04:00
flow_keys.h
garp.h
gen_stats.h
genetlink.h	netlink: Rename pid to portid to avoid confusion	2012-09-10 15:30:41 -04:00
gre.h
gro_cells.h	net: fix a race in gro_cell_poll()	2012-12-11 12:49:53 -05:00
icmp.h
ieee80211_radiotap.h	mac80211: support (partial) VHT radiotap information	2012-11-27 11:56:18 +01:00
ieee802154.h
ieee802154_netdev.h	mac802154: declare reduced mlme operations	2012-05-16 15:16:56 -04:00
if_inet6.h	net: delete all instances of special processing for token ring	2012-05-15 20:14:35 -04:00
inet6_connection_sock.h	ipv6: Add helper inet6_csk_update_pmtu().	2012-07-16 03:44:56 -07:00
inet6_hashtables.h	ipv6: Early TCP socket demux	2012-07-26 15:50:39 -07:00
inet_common.h	net-tcp: Fast Open client - sendmsg(MSG_FASTOPEN)	2012-07-19 11:02:03 -07:00
inet_connection_sock.h	inet: Fix kmemleak in tcp_v4/6_syn_recv_sock and dccp_v4/6_request_recv_sock	2012-12-14 13:14:07 -05:00
inet_ecn.h	tunnel: drop packet if ECN present with not-ECT	2012-09-27 18:12:37 -04:00
inet_frag.h	ipv6: unify fragment thresh handling code	2012-09-19 17:23:28 -04:00
inet_hashtables.h	net: fix sparse endianness warnings on sock_common	2012-12-02 20:23:01 -05:00
inet_sock.h	net: move inet_dport/inet_num in sock_common	2012-11-30 15:02:56 -05:00
inet_timewait_sock.h	net: move inet_dport/inet_num in sock_common	2012-11-30 15:02:56 -05:00
inetpeer.h	ipv4: Maintain redirect and PMTU info in struct rtable again.	2012-07-10 22:40:14 -07:00
ip.h	ipv4: fix path MTU discovery with connection tracking	2012-08-26 19:13:55 +02:00
ip6_checksum.h	ipv6: move csum_ipv6_magic() and udp6_csum_init() into static library	2013-01-08 17:56:10 -08:00
ip6_fib.h	ipv6: remove rt6i_peer_genid from rt6_info and its handler	2012-11-08 21:16:08 -05:00
ip6_route.h	ipv6: export IP6_RT_PRIO_* to userland	2012-11-16 01:47:40 -05:00
ip6_tunnel.h	gre: Support GRE over IPv6	2012-08-14 14:28:32 -07:00
ip_fib.h	ipv4: add a fib_type to fib_info	2012-10-04 13:58:26 -04:00
ip_vs.h	ipvs: fix build errors related to config option combinations	2012-10-23 09:23:40 +09:00
ipcomp.h
ipconfig.h
ipip.h	net: convert __IPTUNNEL_XMIT() to an inline function	2012-11-14 18:49:50 -05:00
ipv6.h	ipv6: Fix endianess warning in ip6_flow_hdr().	2013-01-16 22:12:36 -05:00
ipx.h
iw_handler.h
lapb.h	lapb: Neaten debugging	2012-05-17 18:45:20 -04:00
lib80211.h
llc.h	llc: Remove stray reference to sysctl_llc_station_ack_timeout.	2012-09-17 13:13:24 -04:00
llc_c_ac.h
llc_c_ev.h
llc_c_st.h
llc_conn.h
llc_if.h
llc_pdu.h	net: delete all instances of special processing for token ring	2012-05-15 20:14:35 -04:00
llc_s_ac.h
llc_s_ev.h
llc_s_st.h
llc_sap.h
mac80211.h	mac80211: introduce IEEE80211_HW_TEARDOWN_AGGR_ON_BAR_FAIL	2012-12-05 09:53:31 +01:00
mac802154.h	mac802154: add wpan device-class support	2012-06-26 21:06:11 -07:00
mip6.h
mld.h
ndisc.h	ipv6: Change skb->data before using icmpv6_notify() to propagate redirect	2012-12-14 13:14:07 -05:00
neighbour.h	net: output path optimizations	2012-08-07 16:24:55 -07:00
net_namespace.h	proc: Usable inode numbers for the namespace file descriptors.	2012-11-20 04:19:49 -08:00
net_ratelimit.h
netdma.h
netevent.h	ipv6 netevent: Remove old_neigh from netevent_redirect.	2013-01-14 15:04:59 -05:00
netlabel.h	userns: Convert the audit loginuid to be a kuid	2012-09-17 18:08:54 -07:00
netlink.h	netlink: Rename pid to portid to avoid confusion	2012-09-10 15:30:41 -04:00
netprio_cgroup.h	netprio_cgroup: use cgroup->id instead of cgroup_netprio_state->prioidx	2012-11-22 07:32:47 -08:00
netrom.h
nexthop.h
nl802154.h
p8022.h
ping.h
pkt_cls.h	pkt_sched: namespace aware act_mirred	2013-01-14 15:09:36 -05:00
pkt_sched.h
protocol.h	net: Remove code duplication between offload structures	2012-11-15 17:39:51 -05:00
psnap.h
raw.h
rawv6.h	ipv6: bool/const conversions phase2	2012-05-19 01:08:16 -04:00
red.h
regulatory.h	cfg80211: add cellular base station regulatory hint support	2012-07-17 12:16:39 +02:00
request_sock.h	tcp: better retrans tracking for defer-accept	2012-11-03 14:45:00 -04:00
rose.h
route.h	ipv4: avoid a test in ip_rt_put()	2012-11-03 14:59:04 -04:00
rtnetlink.h	rtnelink: remove unused parameter from rtnl_create_link().	2012-11-30 12:24:40 -05:00
sch_generic.h	pkt_sched: namespace aware act_mirred	2013-01-14 15:09:36 -05:00
scm.h	net: Remove unnecessary NULL check in scm_destroy().	2012-09-24 15:52:33 -04:00
secure_seq.h
slhc_vj.h
snmp.h	net: avoid reloads in SNMP_UPD_PO_STATS	2012-08-06 13:40:47 -07:00
sock.h	sk-filter: Add ability to lock a socket filter program	2013-01-17 03:21:25 -05:00
stp.h
tcp.h	tcp: make sysctl_tcp_ecn namespace aware	2013-01-06 21:09:56 -08:00
tcp_memcontrol.h
tcp_states.h
timewait_sock.h	[PATCH] tcp: Cache inetpeer in timewait socket, and only when necessary.	2012-06-09 14:56:12 -07:00
transp_v6.h
udp.h
udplite.h
wext.h
wimax.h
wpan-phy.h	mac802154: monitor device support	2012-05-16 15:17:08 -04:00
x25.h
x25device.h
xfrm.h	xfrm: Fix the gc threshold value for ipv4	2012-11-13 09:15:07 +01:00