* [PATCH] extensions: libxt_owner: Add complementary groups option [not found] <CGME20190426160306eucas1p1a0c8ec9783cc78db7381582a70d6de10@eucas1p1.samsung.com> @ 2019-04-26 16:02 ` Lukasz Pawelczyk 2019-05-05 22:59 ` Pablo Neira Ayuso 0 siblings, 1 reply; 4+ messages in thread From: Lukasz Pawelczyk @ 2019-04-26 16:02 UTC (permalink / raw) To: Pablo Neira Ayuso, Jozsef Kadlecsik, Florian Westphal, David S. Miller, netfilter-devel, coreteam, netdev, linux-kernel Cc: Lukasz Pawelczyk, Lukasz Pawelczyk The --compl-groups option causes GIDs specified with --gid-owner to be also checked in the complementary groups of a process. Signed-off-by: Lukasz Pawelczyk <l.pawelczyk@samsung.com> --- extensions/libxt_owner.c | 13 ++++++++++++- include/linux/netfilter/xt_owner.h | 1 + 2 files changed, 13 insertions(+), 1 deletion(-) diff --git a/extensions/libxt_owner.c b/extensions/libxt_owner.c index 87e4df31..950d837c 100644 --- a/extensions/libxt_owner.c +++ b/extensions/libxt_owner.c @@ -56,6 +56,7 @@ enum { O_PROCESS, O_SESSION, O_COMM, + O_COMPL_GROUPS, }; static void owner_mt_help_v0(void) @@ -87,7 +88,8 @@ static void owner_mt_help(void) "owner match options:\n" "[!] --uid-owner userid[-userid] Match local UID\n" "[!] --gid-owner groupid[-groupid] Match local GID\n" -"[!] --socket-exists Match if socket exists\n"); +"[!] --socket-exists Match if socket exists\n" +" --compl-groups Also match complementary groups set with --gid-owner\n"); } #define s struct ipt_owner_info @@ -131,6 +133,8 @@ static const struct xt_option_entry owner_mt_opts[] = { .flags = XTOPT_INVERT}, {.name = "socket-exists", .id = O_SOCK_EXISTS, .type = XTTYPE_NONE, .flags = XTOPT_INVERT}, + {.name = "compl-groups", .id = O_COMPL_GROUPS, .type = XTTYPE_NONE, + .flags = XTOPT_INVERT}, XTOPT_TABLEEND, }; @@ -275,6 +279,11 @@ static void owner_mt_parse(struct xt_option_call *cb) info->invert |= XT_OWNER_SOCKET; info->match |= XT_OWNER_SOCKET; break; + case O_COMPL_GROUPS: + if (!(info->match & XT_OWNER_GID)) + xtables_param_act(XTF_BAD_VALUE, "owner", "--compl-groups", "you need to use --gid-owner first"); + info->match |= XT_COMPL_GROUPS; + break; } } @@ -458,6 +467,7 @@ static void owner_mt_print(const void *ip, const struct xt_entry_match *match, owner_mt_print_item(info, "owner socket exists", XT_OWNER_SOCKET, numeric); owner_mt_print_item(info, "owner UID match", XT_OWNER_UID, numeric); owner_mt_print_item(info, "owner GID match", XT_OWNER_GID, numeric); + owner_mt_print_item(info, "incl. compl. groups", XT_COMPL_GROUPS, numeric); } static void @@ -490,6 +500,7 @@ static void owner_mt_save(const void *ip, const struct xt_entry_match *match) owner_mt_print_item(info, "--socket-exists", XT_OWNER_SOCKET, true); owner_mt_print_item(info, "--uid-owner", XT_OWNER_UID, true); owner_mt_print_item(info, "--gid-owner", XT_OWNER_GID, true); + owner_mt_print_item(info, "--compl-groups", XT_COMPL_GROUPS, true); } static int diff --git a/include/linux/netfilter/xt_owner.h b/include/linux/netfilter/xt_owner.h index 20817617..80d49dfd 100644 --- a/include/linux/netfilter/xt_owner.h +++ b/include/linux/netfilter/xt_owner.h @@ -7,6 +7,7 @@ enum { XT_OWNER_UID = 1 << 0, XT_OWNER_GID = 1 << 1, XT_OWNER_SOCKET = 1 << 2, + XT_COMPL_GROUPS = 1 << 3, }; struct xt_owner_match_info { -- 2.20.1 ^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH] extensions: libxt_owner: Add complementary groups option 2019-04-26 16:02 ` [PATCH] extensions: libxt_owner: Add complementary groups option Lukasz Pawelczyk @ 2019-05-05 22:59 ` Pablo Neira Ayuso 2019-05-07 13:24 ` Lukasz Pawelczyk 0 siblings, 1 reply; 4+ messages in thread From: Pablo Neira Ayuso @ 2019-05-05 22:59 UTC (permalink / raw) To: Lukasz Pawelczyk Cc: Jozsef Kadlecsik, Florian Westphal, David S. Miller, netfilter-devel, coreteam, netdev, linux-kernel, Lukasz Pawelczyk On Fri, Apr 26, 2019 at 06:02:57PM +0200, Lukasz Pawelczyk wrote: > The --compl-groups option causes GIDs specified with --gid-owner to be > also checked in the complementary groups of a process. Please, could you also update manpage? BTW, I think you refer to _supplementary_ groups, right? Existing documentation uses this term. ^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] extensions: libxt_owner: Add complementary groups option 2019-05-05 22:59 ` Pablo Neira Ayuso @ 2019-05-07 13:24 ` Lukasz Pawelczyk 2019-05-07 13:35 ` Florian Westphal 0 siblings, 1 reply; 4+ messages in thread From: Lukasz Pawelczyk @ 2019-05-07 13:24 UTC (permalink / raw) To: Pablo Neira Ayuso Cc: Jozsef Kadlecsik, Florian Westphal, David S. Miller, netfilter-devel, coreteam, netdev, linux-kernel, Lukasz Pawelczyk On Mon, 2019-05-06 at 00:59 +0200, Pablo Neira Ayuso wrote: > On Fri, Apr 26, 2019 at 06:02:57PM +0200, Lukasz Pawelczyk wrote: > > The --compl-groups option causes GIDs specified with --gid-owner to > > be > > also checked in the complementary groups of a process. > > Please, could you also update manpage? Will do. iptables-extensions(8) I presume? Anything else? > BTW, I think you refer to _supplementary_ groups, right? Existing > documentation uses this term. Yes, that's correct, my bad. I'll send the updated patches. Thanks. -- Lukasz Pawelczyk Samsung R&D Institute Poland Samsung Electronics ^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] extensions: libxt_owner: Add complementary groups option 2019-05-07 13:24 ` Lukasz Pawelczyk @ 2019-05-07 13:35 ` Florian Westphal 0 siblings, 0 replies; 4+ messages in thread From: Florian Westphal @ 2019-05-07 13:35 UTC (permalink / raw) To: Lukasz Pawelczyk Cc: Pablo Neira Ayuso, Jozsef Kadlecsik, Florian Westphal, David S. Miller, netfilter-devel, coreteam, netdev, linux-kernel, Lukasz Pawelczyk Lukasz Pawelczyk <l.pawelczyk@samsung.com> wrote: > On Mon, 2019-05-06 at 00:59 +0200, Pablo Neira Ayuso wrote: > > On Fri, Apr 26, 2019 at 06:02:57PM +0200, Lukasz Pawelczyk wrote: > > > The --compl-groups option causes GIDs specified with --gid-owner to > > > be > > > also checked in the complementary groups of a process. > > > > Please, could you also update manpage? > > Will do. iptables-extensions(8) I presume? Anything else? Yes, thats the one. ^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2019-05-07 13:35 UTC | newest] Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- [not found] <CGME20190426160306eucas1p1a0c8ec9783cc78db7381582a70d6de10@eucas1p1.samsung.com> 2019-04-26 16:02 ` [PATCH] extensions: libxt_owner: Add complementary groups option Lukasz Pawelczyk 2019-05-05 22:59 ` Pablo Neira Ayuso 2019-05-07 13:24 ` Lukasz Pawelczyk 2019-05-07 13:35 ` Florian Westphal
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).