From cdee765643d7a4ab91477d6287507f61d586e841 Mon Sep 17 00:00:00 2001
From: Matheus <matheusuky@gmail.com>
Date: Mon, 14 Sep 2026 14:03:39 -0300
Subject: [PATCH] raw sockets: make creating them a privileged operation

---
 kernel-src/include/kernel/auth.h | 1 +
 kernel-src/io/net/raw.c          | 3 ---
 kernel-src/sys/syscalls/socket.c | 7 +++++++
 3 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/kernel-src/include/kernel/auth.h b/kernel-src/include/kernel/auth.h
index 8e1e2006..843952c3 100644
--- a/kernel-src/include/kernel/auth.h
+++ b/kernel-src/include/kernel/auth.h
@@ -43,6 +43,7 @@
 
 #define AUTH_ACTIONS_NETWORK_CONFIGURE		1
 #define AUTH_ACTIONS_NETWORK_BINDRESERVED	2
+#define AUTH_ACTIONS_NETWORK_CREATERAW		4
 
 typedef int (*authlistener_t)(cred_t *cred, int actions, void *arg0, void *arg1, void *arg2);
 
diff --git a/kernel-src/io/net/raw.c b/kernel-src/io/net/raw.c
index cfe64046..11a7fc14 100644
--- a/kernel-src/io/net/raw.c
+++ b/kernel-src/io/net/raw.c
@@ -6,13 +6,10 @@
 #include <spinlock.h>
 #include <kernel/interrupt.h>
 #include <ringbuffer.h>
-#include <kernel/auth.h>
 #include <list.h>
 
 #define SOCKET_BUFFER (16 * 1024)
 
-// TODO: check user creating socket is root
-
 SPINLOCK_DEFINE(list_lock);
 static list_t socket_list;
 
diff --git a/kernel-src/sys/syscalls/socket.c b/kernel-src/sys/syscalls/socket.c
index 37ed1223..074e689f 100644
--- a/kernel-src/sys/syscalls/socket.c
+++ b/kernel-src/sys/syscalls/socket.c
@@ -1,5 +1,6 @@
 #include <kernel/syscalls.h>
 #include <kernel/abi.h>
+#include <kernel/auth.h>
 #include <kernel/sock.h>
 #include <errno.h>
 
@@ -48,6 +49,12 @@ syscallret_t syscall_socket(context_t *, int domain, int type, int protocol) {
 		return ret;
 	}
 
+	if (socktype == SOCKET_TYPE_RAW_STRIPPED) {
+		ret.errno = auth_network_check(&current_thread()->proc->cred, AUTH_ACTIONS_NETWORK_CREATERAW, NULL, NULL);
+		if (ret.errno)
+			return ret;
+	}
+
 	socket_t *socket = socket_create(socktype, protocol);
 	if (socket == NULL) {
 		ret.errno = ENOMEM;