From 4db1a65a0775ce3cc65febc41ac84f5cfc81a51c Mon Sep 17 00:00:00 2001
From: "Yuriy M. Kaminskiy" <yumkam@gmail.com>
Date: Mon, 22 Feb 2016 02:15:45 +0300
Subject: Add compile-time option to restrict --net= to root only

./configure --enable-network=restricted allows only --net=none to
non-root users.

Other variants delegate too much power to non-root users and dangerous (it
completely bypasses system-wide firewall and routing, it allows introducing
arbitrary-chosen MAC and IP interfaces on LAN [disregarding DHCP
policy], etc).
Root already had power to twiddle with anything, so no sense to restrain
her, and --net=none looks safe enough (and still useful) for ordinary
users.
---
 configure.ac | 3 +++
 1 file changed, 3 insertions(+)

(limited to 'configure.ac')

diff --git a/configure.ac b/configure.ac
index f9d0a3f65..f39b0d780 100644
--- a/configure.ac
+++ b/configure.ac
@@ -38,6 +38,9 @@ AC_ARG_ENABLE([network],
     AS_HELP_STRING([--disable-network], [disable network]))
 AS_IF([test "x$enable_network" != "xno"], [
 	HAVE_NETWORK="-DHAVE_NETWORK"
+	AS_IF([test "x$enable_network" = "xrestricted"], [
+	       HAVE_NETWORK="$HAVE_NETWORK -DHAVE_NETWORK_RESTRICTED"
+	])
 	AC_SUBST(HAVE_NETWORK)
 ])
 
-- 
cgit v1.2.3-54-g00ecf