* [PATCH] extensions: libxt_owner: Add complementary groups option
[not found] <CGME20190426160306eucas1p1a0c8ec9783cc78db7381582a70d6de10@eucas1p1.samsung.com>
@ 2019-04-26 16:02 ` Lukasz Pawelczyk
2019-05-05 22:59 ` Pablo Neira Ayuso
0 siblings, 1 reply; 4+ messages in thread
From: Lukasz Pawelczyk @ 2019-04-26 16:02 UTC (permalink / raw)
To: Pablo Neira Ayuso, Jozsef Kadlecsik, Florian Westphal,
David S. Miller, netfilter-devel, coreteam, netdev, linux-kernel
Cc: Lukasz Pawelczyk, Lukasz Pawelczyk
The --compl-groups option causes GIDs specified with --gid-owner to be
also checked in the complementary groups of a process.
Signed-off-by: Lukasz Pawelczyk <l.pawelczyk@samsung.com>
---
extensions/libxt_owner.c | 13 ++++++++++++-
include/linux/netfilter/xt_owner.h | 1 +
2 files changed, 13 insertions(+), 1 deletion(-)
diff --git a/extensions/libxt_owner.c b/extensions/libxt_owner.c
index 87e4df31..950d837c 100644
--- a/extensions/libxt_owner.c
+++ b/extensions/libxt_owner.c
@@ -56,6 +56,7 @@ enum {
O_PROCESS,
O_SESSION,
O_COMM,
+ O_COMPL_GROUPS,
};
static void owner_mt_help_v0(void)
@@ -87,7 +88,8 @@ static void owner_mt_help(void)
"owner match options:\n"
"[!] --uid-owner userid[-userid] Match local UID\n"
"[!] --gid-owner groupid[-groupid] Match local GID\n"
-"[!] --socket-exists Match if socket exists\n");
+"[!] --socket-exists Match if socket exists\n"
+" --compl-groups Also match complementary groups set with --gid-owner\n");
}
#define s struct ipt_owner_info
@@ -131,6 +133,8 @@ static const struct xt_option_entry owner_mt_opts[] = {
.flags = XTOPT_INVERT},
{.name = "socket-exists", .id = O_SOCK_EXISTS, .type = XTTYPE_NONE,
.flags = XTOPT_INVERT},
+ {.name = "compl-groups", .id = O_COMPL_GROUPS, .type = XTTYPE_NONE,
+ .flags = XTOPT_INVERT},
XTOPT_TABLEEND,
};
@@ -275,6 +279,11 @@ static void owner_mt_parse(struct xt_option_call *cb)
info->invert |= XT_OWNER_SOCKET;
info->match |= XT_OWNER_SOCKET;
break;
+ case O_COMPL_GROUPS:
+ if (!(info->match & XT_OWNER_GID))
+ xtables_param_act(XTF_BAD_VALUE, "owner", "--compl-groups", "you need to use --gid-owner first");
+ info->match |= XT_COMPL_GROUPS;
+ break;
}
}
@@ -458,6 +467,7 @@ static void owner_mt_print(const void *ip, const struct xt_entry_match *match,
owner_mt_print_item(info, "owner socket exists", XT_OWNER_SOCKET, numeric);
owner_mt_print_item(info, "owner UID match", XT_OWNER_UID, numeric);
owner_mt_print_item(info, "owner GID match", XT_OWNER_GID, numeric);
+ owner_mt_print_item(info, "incl. compl. groups", XT_COMPL_GROUPS, numeric);
}
static void
@@ -490,6 +500,7 @@ static void owner_mt_save(const void *ip, const struct xt_entry_match *match)
owner_mt_print_item(info, "--socket-exists", XT_OWNER_SOCKET, true);
owner_mt_print_item(info, "--uid-owner", XT_OWNER_UID, true);
owner_mt_print_item(info, "--gid-owner", XT_OWNER_GID, true);
+ owner_mt_print_item(info, "--compl-groups", XT_COMPL_GROUPS, true);
}
static int
diff --git a/include/linux/netfilter/xt_owner.h b/include/linux/netfilter/xt_owner.h
index 20817617..80d49dfd 100644
--- a/include/linux/netfilter/xt_owner.h
+++ b/include/linux/netfilter/xt_owner.h
@@ -7,6 +7,7 @@ enum {
XT_OWNER_UID = 1 << 0,
XT_OWNER_GID = 1 << 1,
XT_OWNER_SOCKET = 1 << 2,
+ XT_COMPL_GROUPS = 1 << 3,
};
struct xt_owner_match_info {
--
2.20.1
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH] extensions: libxt_owner: Add complementary groups option
2019-04-26 16:02 ` [PATCH] extensions: libxt_owner: Add complementary groups option Lukasz Pawelczyk
@ 2019-05-05 22:59 ` Pablo Neira Ayuso
2019-05-07 13:24 ` Lukasz Pawelczyk
0 siblings, 1 reply; 4+ messages in thread
From: Pablo Neira Ayuso @ 2019-05-05 22:59 UTC (permalink / raw)
To: Lukasz Pawelczyk
Cc: Jozsef Kadlecsik, Florian Westphal, David S. Miller,
netfilter-devel, coreteam, netdev, linux-kernel,
Lukasz Pawelczyk
On Fri, Apr 26, 2019 at 06:02:57PM +0200, Lukasz Pawelczyk wrote:
> The --compl-groups option causes GIDs specified with --gid-owner to be
> also checked in the complementary groups of a process.
Please, could you also update manpage?
BTW, I think you refer to _supplementary_ groups, right? Existing
documentation uses this term.
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] extensions: libxt_owner: Add complementary groups option
2019-05-05 22:59 ` Pablo Neira Ayuso
@ 2019-05-07 13:24 ` Lukasz Pawelczyk
2019-05-07 13:35 ` Florian Westphal
0 siblings, 1 reply; 4+ messages in thread
From: Lukasz Pawelczyk @ 2019-05-07 13:24 UTC (permalink / raw)
To: Pablo Neira Ayuso
Cc: Jozsef Kadlecsik, Florian Westphal, David S. Miller,
netfilter-devel, coreteam, netdev, linux-kernel,
Lukasz Pawelczyk
On Mon, 2019-05-06 at 00:59 +0200, Pablo Neira Ayuso wrote:
> On Fri, Apr 26, 2019 at 06:02:57PM +0200, Lukasz Pawelczyk wrote:
> > The --compl-groups option causes GIDs specified with --gid-owner to
> > be
> > also checked in the complementary groups of a process.
>
> Please, could you also update manpage?
Will do. iptables-extensions(8) I presume? Anything else?
> BTW, I think you refer to _supplementary_ groups, right? Existing
> documentation uses this term.
Yes, that's correct, my bad. I'll send the updated patches.
Thanks.
--
Lukasz Pawelczyk
Samsung R&D Institute Poland
Samsung Electronics
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] extensions: libxt_owner: Add complementary groups option
2019-05-07 13:24 ` Lukasz Pawelczyk
@ 2019-05-07 13:35 ` Florian Westphal
0 siblings, 0 replies; 4+ messages in thread
From: Florian Westphal @ 2019-05-07 13:35 UTC (permalink / raw)
To: Lukasz Pawelczyk
Cc: Pablo Neira Ayuso, Jozsef Kadlecsik, Florian Westphal,
David S. Miller, netfilter-devel, coreteam, netdev, linux-kernel,
Lukasz Pawelczyk
Lukasz Pawelczyk <l.pawelczyk@samsung.com> wrote:
> On Mon, 2019-05-06 at 00:59 +0200, Pablo Neira Ayuso wrote:
> > On Fri, Apr 26, 2019 at 06:02:57PM +0200, Lukasz Pawelczyk wrote:
> > > The --compl-groups option causes GIDs specified with --gid-owner to
> > > be
> > > also checked in the complementary groups of a process.
> >
> > Please, could you also update manpage?
>
> Will do. iptables-extensions(8) I presume? Anything else?
Yes, thats the one.
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2019-05-07 13:35 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
[not found] <CGME20190426160306eucas1p1a0c8ec9783cc78db7381582a70d6de10@eucas1p1.samsung.com>
2019-04-26 16:02 ` [PATCH] extensions: libxt_owner: Add complementary groups option Lukasz Pawelczyk
2019-05-05 22:59 ` Pablo Neira Ayuso
2019-05-07 13:24 ` Lukasz Pawelczyk
2019-05-07 13:35 ` Florian Westphal
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.