* [PATCH v4] extensions: libxt_owner: Add supplementary groups option [not found] <CGME20190610094353eucas1p29eb71e82aa621c1e387513571a78710b@eucas1p2.samsung.com> @ 2019-06-10 9:42 ` Lukasz Pawelczyk 2019-06-10 10:34 ` Pablo Neira Ayuso 0 siblings, 1 reply; 2+ messages in thread From: Lukasz Pawelczyk @ 2019-06-10 9:42 UTC (permalink / raw) To: Pablo Neira Ayuso, Jozsef Kadlecsik, Florian Westphal, David S. Miller, netfilter-devel, coreteam, netdev, linux-kernel Cc: Lukasz Pawelczyk, Lukasz Pawelczyk The --suppl-groups option causes GIDs specified with --gid-owner to be also checked in the supplementary groups of a process. Signed-off-by: Lukasz Pawelczyk <l.pawelczyk@samsung.com> --- Changes from v3: - removed XTOPT_INVERT from O_SUPPL_GROUPS, it wasn't meant to be invertable Changes from v2: - XT_SUPPL_GROUPS -> XT_OWNER_SUPPL_GROUPS Changes from v1: - complementary -> supplementary - manual (iptables-extensions) extensions/libxt_owner.c | 24 +++++++++++++++++------- extensions/libxt_owner.man | 4 ++++ include/linux/netfilter/xt_owner.h | 7 ++++--- 3 files changed, 25 insertions(+), 10 deletions(-) diff --git a/extensions/libxt_owner.c b/extensions/libxt_owner.c index 87e4df31..1702b478 100644 --- a/extensions/libxt_owner.c +++ b/extensions/libxt_owner.c @@ -56,6 +56,7 @@ enum { O_PROCESS, O_SESSION, O_COMM, + O_SUPPL_GROUPS, }; static void owner_mt_help_v0(void) @@ -87,7 +88,8 @@ static void owner_mt_help(void) "owner match options:\n" "[!] --uid-owner userid[-userid] Match local UID\n" "[!] --gid-owner groupid[-groupid] Match local GID\n" -"[!] --socket-exists Match if socket exists\n"); +"[!] --socket-exists Match if socket exists\n" +" --suppl-groups Also match supplementary groups set with --gid-owner\n"); } #define s struct ipt_owner_info @@ -131,6 +133,7 @@ static const struct xt_option_entry owner_mt_opts[] = { .flags = XTOPT_INVERT}, {.name = "socket-exists", .id = O_SOCK_EXISTS, .type = XTTYPE_NONE, .flags = XTOPT_INVERT}, + {.name = "suppl-groups", .id = O_SUPPL_GROUPS, .type = XTTYPE_NONE}, XTOPT_TABLEEND, }; @@ -275,6 +278,11 @@ static void owner_mt_parse(struct xt_option_call *cb) info->invert |= XT_OWNER_SOCKET; info->match |= XT_OWNER_SOCKET; break; + case O_SUPPL_GROUPS: + if (!(info->match & XT_OWNER_GID)) + xtables_param_act(XTF_BAD_VALUE, "owner", "--suppl-groups", "you need to use --gid-owner first"); + info->match |= XT_OWNER_SUPPL_GROUPS; + break; } } @@ -455,9 +463,10 @@ static void owner_mt_print(const void *ip, const struct xt_entry_match *match, { const struct xt_owner_match_info *info = (void *)match->data; - owner_mt_print_item(info, "owner socket exists", XT_OWNER_SOCKET, numeric); - owner_mt_print_item(info, "owner UID match", XT_OWNER_UID, numeric); - owner_mt_print_item(info, "owner GID match", XT_OWNER_GID, numeric); + owner_mt_print_item(info, "owner socket exists", XT_OWNER_SOCKET, numeric); + owner_mt_print_item(info, "owner UID match", XT_OWNER_UID, numeric); + owner_mt_print_item(info, "owner GID match", XT_OWNER_GID, numeric); + owner_mt_print_item(info, "incl. suppl. groups", XT_OWNER_SUPPL_GROUPS, numeric); } static void @@ -487,9 +496,10 @@ static void owner_mt_save(const void *ip, const struct xt_entry_match *match) { const struct xt_owner_match_info *info = (void *)match->data; - owner_mt_print_item(info, "--socket-exists", XT_OWNER_SOCKET, true); - owner_mt_print_item(info, "--uid-owner", XT_OWNER_UID, true); - owner_mt_print_item(info, "--gid-owner", XT_OWNER_GID, true); + owner_mt_print_item(info, "--socket-exists", XT_OWNER_SOCKET, true); + owner_mt_print_item(info, "--uid-owner", XT_OWNER_UID, true); + owner_mt_print_item(info, "--gid-owner", XT_OWNER_GID, true); + owner_mt_print_item(info, "--suppl-groups", XT_OWNER_SUPPL_GROUPS, true); } static int diff --git a/extensions/libxt_owner.man b/extensions/libxt_owner.man index 49b58cee..e2479865 100644 --- a/extensions/libxt_owner.man +++ b/extensions/libxt_owner.man @@ -15,5 +15,9 @@ given user. You may also specify a numerical UID, or an UID range. Matches if the packet socket's file structure is owned by the given group. You may also specify a numerical GID, or a GID range. .TP +\fB\-\-suppl\-groups\fP +Causes group(s) specified with \fB\-\-gid-owner\fP to be also checked in the +supplementary groups of a process. +.TP [\fB!\fP] \fB\-\-socket\-exists\fP Matches if the packet is associated with a socket. diff --git a/include/linux/netfilter/xt_owner.h b/include/linux/netfilter/xt_owner.h index 20817617..e7731dcc 100644 --- a/include/linux/netfilter/xt_owner.h +++ b/include/linux/netfilter/xt_owner.h @@ -4,9 +4,10 @@ #include <linux/types.h> enum { - XT_OWNER_UID = 1 << 0, - XT_OWNER_GID = 1 << 1, - XT_OWNER_SOCKET = 1 << 2, + XT_OWNER_UID = 1 << 0, + XT_OWNER_GID = 1 << 1, + XT_OWNER_SOCKET = 1 << 2, + XT_OWNER_SUPPL_GROUPS = 1 << 3, }; struct xt_owner_match_info { -- 2.20.1 ^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH v4] extensions: libxt_owner: Add supplementary groups option 2019-06-10 9:42 ` [PATCH v4] extensions: libxt_owner: Add supplementary groups option Lukasz Pawelczyk @ 2019-06-10 10:34 ` Pablo Neira Ayuso 0 siblings, 0 replies; 2+ messages in thread From: Pablo Neira Ayuso @ 2019-06-10 10:34 UTC (permalink / raw) To: Lukasz Pawelczyk Cc: Jozsef Kadlecsik, Florian Westphal, David S. Miller, netfilter-devel, coreteam, netdev, linux-kernel, Lukasz Pawelczyk On Mon, Jun 10, 2019 at 11:42:38AM +0200, Lukasz Pawelczyk wrote: > The --suppl-groups option causes GIDs specified with --gid-owner to be > also checked in the supplementary groups of a process. Could you also extend iptables/extensions/libxt_owner.t ? Thanks. > Signed-off-by: Lukasz Pawelczyk <l.pawelczyk@samsung.com> > --- > > Changes from v3: > - removed XTOPT_INVERT from O_SUPPL_GROUPS, > it wasn't meant to be invertable > > Changes from v2: > - XT_SUPPL_GROUPS -> XT_OWNER_SUPPL_GROUPS > > Changes from v1: > - complementary -> supplementary > - manual (iptables-extensions) > > extensions/libxt_owner.c | 24 +++++++++++++++++------- > extensions/libxt_owner.man | 4 ++++ > include/linux/netfilter/xt_owner.h | 7 ++++--- > 3 files changed, 25 insertions(+), 10 deletions(-) > > diff --git a/extensions/libxt_owner.c b/extensions/libxt_owner.c > index 87e4df31..1702b478 100644 > --- a/extensions/libxt_owner.c > +++ b/extensions/libxt_owner.c > @@ -56,6 +56,7 @@ enum { > O_PROCESS, > O_SESSION, > O_COMM, > + O_SUPPL_GROUPS, > }; > > static void owner_mt_help_v0(void) > @@ -87,7 +88,8 @@ static void owner_mt_help(void) > "owner match options:\n" > "[!] --uid-owner userid[-userid] Match local UID\n" > "[!] --gid-owner groupid[-groupid] Match local GID\n" > -"[!] --socket-exists Match if socket exists\n"); > +"[!] --socket-exists Match if socket exists\n" > +" --suppl-groups Also match supplementary groups set with --gid-owner\n"); > } > > #define s struct ipt_owner_info > @@ -131,6 +133,7 @@ static const struct xt_option_entry owner_mt_opts[] = { > .flags = XTOPT_INVERT}, > {.name = "socket-exists", .id = O_SOCK_EXISTS, .type = XTTYPE_NONE, > .flags = XTOPT_INVERT}, > + {.name = "suppl-groups", .id = O_SUPPL_GROUPS, .type = XTTYPE_NONE}, > XTOPT_TABLEEND, > }; > > @@ -275,6 +278,11 @@ static void owner_mt_parse(struct xt_option_call *cb) > info->invert |= XT_OWNER_SOCKET; > info->match |= XT_OWNER_SOCKET; > break; > + case O_SUPPL_GROUPS: > + if (!(info->match & XT_OWNER_GID)) > + xtables_param_act(XTF_BAD_VALUE, "owner", "--suppl-groups", "you need to use --gid-owner first"); > + info->match |= XT_OWNER_SUPPL_GROUPS; > + break; > } > } > > @@ -455,9 +463,10 @@ static void owner_mt_print(const void *ip, const struct xt_entry_match *match, > { > const struct xt_owner_match_info *info = (void *)match->data; > > - owner_mt_print_item(info, "owner socket exists", XT_OWNER_SOCKET, numeric); > - owner_mt_print_item(info, "owner UID match", XT_OWNER_UID, numeric); > - owner_mt_print_item(info, "owner GID match", XT_OWNER_GID, numeric); > + owner_mt_print_item(info, "owner socket exists", XT_OWNER_SOCKET, numeric); > + owner_mt_print_item(info, "owner UID match", XT_OWNER_UID, numeric); > + owner_mt_print_item(info, "owner GID match", XT_OWNER_GID, numeric); > + owner_mt_print_item(info, "incl. suppl. groups", XT_OWNER_SUPPL_GROUPS, numeric); > } > > static void > @@ -487,9 +496,10 @@ static void owner_mt_save(const void *ip, const struct xt_entry_match *match) > { > const struct xt_owner_match_info *info = (void *)match->data; > > - owner_mt_print_item(info, "--socket-exists", XT_OWNER_SOCKET, true); > - owner_mt_print_item(info, "--uid-owner", XT_OWNER_UID, true); > - owner_mt_print_item(info, "--gid-owner", XT_OWNER_GID, true); > + owner_mt_print_item(info, "--socket-exists", XT_OWNER_SOCKET, true); > + owner_mt_print_item(info, "--uid-owner", XT_OWNER_UID, true); > + owner_mt_print_item(info, "--gid-owner", XT_OWNER_GID, true); > + owner_mt_print_item(info, "--suppl-groups", XT_OWNER_SUPPL_GROUPS, true); > } > > static int > diff --git a/extensions/libxt_owner.man b/extensions/libxt_owner.man > index 49b58cee..e2479865 100644 > --- a/extensions/libxt_owner.man > +++ b/extensions/libxt_owner.man > @@ -15,5 +15,9 @@ given user. You may also specify a numerical UID, or an UID range. > Matches if the packet socket's file structure is owned by the given group. > You may also specify a numerical GID, or a GID range. > .TP > +\fB\-\-suppl\-groups\fP > +Causes group(s) specified with \fB\-\-gid-owner\fP to be also checked in the > +supplementary groups of a process. > +.TP > [\fB!\fP] \fB\-\-socket\-exists\fP > Matches if the packet is associated with a socket. > diff --git a/include/linux/netfilter/xt_owner.h b/include/linux/netfilter/xt_owner.h > index 20817617..e7731dcc 100644 > --- a/include/linux/netfilter/xt_owner.h > +++ b/include/linux/netfilter/xt_owner.h > @@ -4,9 +4,10 @@ > #include <linux/types.h> > > enum { > - XT_OWNER_UID = 1 << 0, > - XT_OWNER_GID = 1 << 1, > - XT_OWNER_SOCKET = 1 << 2, > + XT_OWNER_UID = 1 << 0, > + XT_OWNER_GID = 1 << 1, > + XT_OWNER_SOCKET = 1 << 2, > + XT_OWNER_SUPPL_GROUPS = 1 << 3, > }; > > struct xt_owner_match_info { > -- > 2.20.1 > ^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2019-06-10 10:34 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <CGME20190610094353eucas1p29eb71e82aa621c1e387513571a78710b@eucas1p2.samsung.com>
2019-06-10 9:42 ` [PATCH v4] extensions: libxt_owner: Add supplementary groups option Lukasz Pawelczyk
2019-06-10 10:34 ` Pablo Neira Ayuso
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox