Re: [PATCH] ipt_recent: add module parameter for changing GID of /proc/net/ipt_recent/*

[Daniel De Graaf <danield@iastate.edu>]

[-- Attachment #1: Type: text/plain, Size: 1144 bytes --]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Patrick McHardy wrote:
> Daniel De Graaf wrote:
>> This patch adds an ip_list_gid module parameter to ipt_recent,
>> which is meant to be used in combination with the ip_list_perms.
>> In the current implementation, the files must either be
>> world-writable or require programs which write to them to be (at
>> least) setgid root.
>>
>> - Daniel De Graaf
>
> /* Structure of our list of recently seen addresses. */ struct
> recent_ip_list { @@ -852,6 +855,7 @@ } 
> curr_table->status_proc->owner = THIS_MODULE; +
> curr_table->status_proc->gid = ip_list_gid;
> curr_table->status_proc->data = curr_table; wmb();
> curr_table->status_proc->read_proc = ip_recent_get_info;
>
>
> That code is gone for good, please check if your patch is still
> necessary for current -git and resubmit in case it is.
Here's an updated patch against 2.6.18-rc1.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFEryWfZz9quLVV3/MRAoFbAJ0bl5jhgADEm4ppII7etF4g4/Qc5ACfRtzQ
27lEptoQ9kHdv5XusVx7L1w=
=VJVi
-----END PGP SIGNATURE-----


[-- Attachment #2: ipt_recent.patch --]
[-- Type: text/x-patch, Size: 1108 bytes --]

--- ipt_recent.c.old	2006-07-07 22:17:37.000000000 -0500
+++ ipt_recent.c	2006-07-07 22:23:36.000000000 -0500
@@ -35,14 +35,17 @@
 static unsigned int ip_pkt_list_tot = 20;
 static unsigned int ip_list_hash_size = 0;
 static unsigned int ip_list_perms = 0644;
+static unsigned int ip_list_gid = 0;
 module_param(ip_list_tot, uint, 0400);
 module_param(ip_pkt_list_tot, uint, 0400);
 module_param(ip_list_hash_size, uint, 0400);
 module_param(ip_list_perms, uint, 0400);
+module_param(ip_list_gid, uint, 0400);
 MODULE_PARM_DESC(ip_list_tot, "number of IPs to remember per list");
 MODULE_PARM_DESC(ip_pkt_list_tot, "number of packets per IP to remember (max. 255)");
 MODULE_PARM_DESC(ip_list_hash_size, "size of hash table used to look up IPs");
 MODULE_PARM_DESC(ip_list_perms, "permissions on /proc/net/ipt_recent/* files");
+MODULE_PARM_DESC(ip_list_gid,"owning group of /proc/net/ipt_recent/* files");
 
 
 struct recent_entry {
@@ -274,6 +277,7 @@
 		goto out;
 	}
 	t->proc->proc_fops = &recent_fops;
+	t->proc->gid       = ip_list_gid;
 	t->proc->data      = t;
 #endif
 	spin_lock_bh(&recent_lock);