linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH v4] extensions: libxt_owner: Add supplementary groups option
       [not found] <CGME20190610094353eucas1p29eb71e82aa621c1e387513571a78710b@eucas1p2.samsung.com>
@ 2019-06-10  9:42 ` Lukasz Pawelczyk
  2019-06-10 10:34   ` Pablo Neira Ayuso
  0 siblings, 1 reply; 2+ messages in thread
From: Lukasz Pawelczyk @ 2019-06-10  9:42 UTC (permalink / raw)
  To: Pablo Neira Ayuso, Jozsef Kadlecsik, Florian Westphal,
	David S. Miller, netfilter-devel, coreteam, netdev, linux-kernel
  Cc: Lukasz Pawelczyk, Lukasz Pawelczyk

The --suppl-groups option causes GIDs specified with --gid-owner to be
also checked in the supplementary groups of a process.

Signed-off-by: Lukasz Pawelczyk <l.pawelczyk@samsung.com>
---

Changes from v3:
 - removed XTOPT_INVERT from O_SUPPL_GROUPS,
   it wasn't meant to be invertable
    
Changes from v2:
 - XT_SUPPL_GROUPS -> XT_OWNER_SUPPL_GROUPS
    
Changes from v1:
 - complementary -> supplementary
 - manual (iptables-extensions)

 extensions/libxt_owner.c           | 24 +++++++++++++++++-------
 extensions/libxt_owner.man         |  4 ++++
 include/linux/netfilter/xt_owner.h |  7 ++++---
 3 files changed, 25 insertions(+), 10 deletions(-)

diff --git a/extensions/libxt_owner.c b/extensions/libxt_owner.c
index 87e4df31..1702b478 100644
--- a/extensions/libxt_owner.c
+++ b/extensions/libxt_owner.c
@@ -56,6 +56,7 @@ enum {
 	O_PROCESS,
 	O_SESSION,
 	O_COMM,
+	O_SUPPL_GROUPS,
 };
 
 static void owner_mt_help_v0(void)
@@ -87,7 +88,8 @@ static void owner_mt_help(void)
 "owner match options:\n"
 "[!] --uid-owner userid[-userid]      Match local UID\n"
 "[!] --gid-owner groupid[-groupid]    Match local GID\n"
-"[!] --socket-exists                  Match if socket exists\n");
+"[!] --socket-exists                  Match if socket exists\n"
+"    --suppl-groups                   Also match supplementary groups set with --gid-owner\n");
 }
 
 #define s struct ipt_owner_info
@@ -131,6 +133,7 @@ static const struct xt_option_entry owner_mt_opts[] = {
 	 .flags = XTOPT_INVERT},
 	{.name = "socket-exists", .id = O_SOCK_EXISTS, .type = XTTYPE_NONE,
 	 .flags = XTOPT_INVERT},
+	{.name = "suppl-groups", .id = O_SUPPL_GROUPS, .type = XTTYPE_NONE},
 	XTOPT_TABLEEND,
 };
 
@@ -275,6 +278,11 @@ static void owner_mt_parse(struct xt_option_call *cb)
 			info->invert |= XT_OWNER_SOCKET;
 		info->match |= XT_OWNER_SOCKET;
 		break;
+	case O_SUPPL_GROUPS:
+		if (!(info->match & XT_OWNER_GID))
+			xtables_param_act(XTF_BAD_VALUE, "owner", "--suppl-groups", "you need to use --gid-owner first");
+		info->match |= XT_OWNER_SUPPL_GROUPS;
+		break;
 	}
 }
 
@@ -455,9 +463,10 @@ static void owner_mt_print(const void *ip, const struct xt_entry_match *match,
 {
 	const struct xt_owner_match_info *info = (void *)match->data;
 
-	owner_mt_print_item(info, "owner socket exists", XT_OWNER_SOCKET, numeric);
-	owner_mt_print_item(info, "owner UID match",     XT_OWNER_UID,    numeric);
-	owner_mt_print_item(info, "owner GID match",     XT_OWNER_GID,    numeric);
+	owner_mt_print_item(info, "owner socket exists", XT_OWNER_SOCKET,       numeric);
+	owner_mt_print_item(info, "owner UID match",     XT_OWNER_UID,          numeric);
+	owner_mt_print_item(info, "owner GID match",     XT_OWNER_GID,          numeric);
+	owner_mt_print_item(info, "incl. suppl. groups", XT_OWNER_SUPPL_GROUPS, numeric);
 }
 
 static void
@@ -487,9 +496,10 @@ static void owner_mt_save(const void *ip, const struct xt_entry_match *match)
 {
 	const struct xt_owner_match_info *info = (void *)match->data;
 
-	owner_mt_print_item(info, "--socket-exists",  XT_OWNER_SOCKET, true);
-	owner_mt_print_item(info, "--uid-owner",      XT_OWNER_UID,    true);
-	owner_mt_print_item(info, "--gid-owner",      XT_OWNER_GID,    true);
+	owner_mt_print_item(info, "--socket-exists",  XT_OWNER_SOCKET,       true);
+	owner_mt_print_item(info, "--uid-owner",      XT_OWNER_UID,          true);
+	owner_mt_print_item(info, "--gid-owner",      XT_OWNER_GID,          true);
+	owner_mt_print_item(info, "--suppl-groups",   XT_OWNER_SUPPL_GROUPS, true);
 }
 
 static int
diff --git a/extensions/libxt_owner.man b/extensions/libxt_owner.man
index 49b58cee..e2479865 100644
--- a/extensions/libxt_owner.man
+++ b/extensions/libxt_owner.man
@@ -15,5 +15,9 @@ given user. You may also specify a numerical UID, or an UID range.
 Matches if the packet socket's file structure is owned by the given group.
 You may also specify a numerical GID, or a GID range.
 .TP
+\fB\-\-suppl\-groups\fP
+Causes group(s) specified with \fB\-\-gid-owner\fP to be also checked in the
+supplementary groups of a process.
+.TP
 [\fB!\fP] \fB\-\-socket\-exists\fP
 Matches if the packet is associated with a socket.
diff --git a/include/linux/netfilter/xt_owner.h b/include/linux/netfilter/xt_owner.h
index 20817617..e7731dcc 100644
--- a/include/linux/netfilter/xt_owner.h
+++ b/include/linux/netfilter/xt_owner.h
@@ -4,9 +4,10 @@
 #include <linux/types.h>
 
 enum {
-	XT_OWNER_UID    = 1 << 0,
-	XT_OWNER_GID    = 1 << 1,
-	XT_OWNER_SOCKET = 1 << 2,
+	XT_OWNER_UID          = 1 << 0,
+	XT_OWNER_GID          = 1 << 1,
+	XT_OWNER_SOCKET       = 1 << 2,
+	XT_OWNER_SUPPL_GROUPS = 1 << 3,
 };
 
 struct xt_owner_match_info {
-- 
2.20.1


^ permalink raw reply related	[flat|nested] 2+ messages in thread
* Re: [PATCH v4] extensions: libxt_owner: Add supplementary groups option
  2019-06-10  9:42 ` [PATCH v4] extensions: libxt_owner: Add supplementary groups option Lukasz Pawelczyk
@ 2019-06-10 10:34   ` Pablo Neira Ayuso
  0 siblings, 0 replies; 2+ messages in thread
From: Pablo Neira Ayuso @ 2019-06-10 10:34 UTC (permalink / raw)
  To: Lukasz Pawelczyk
  Cc: Jozsef Kadlecsik, Florian Westphal, David S. Miller,
	netfilter-devel, coreteam, netdev, linux-kernel,
	Lukasz Pawelczyk

On Mon, Jun 10, 2019 at 11:42:38AM +0200, Lukasz Pawelczyk wrote:
> The --suppl-groups option causes GIDs specified with --gid-owner to be
> also checked in the supplementary groups of a process.

Could you also extend iptables/extensions/libxt_owner.t ?

Thanks.

> Signed-off-by: Lukasz Pawelczyk <l.pawelczyk@samsung.com>
> ---
> 
> Changes from v3:
>  - removed XTOPT_INVERT from O_SUPPL_GROUPS,
>    it wasn't meant to be invertable
>     
> Changes from v2:
>  - XT_SUPPL_GROUPS -> XT_OWNER_SUPPL_GROUPS
>     
> Changes from v1:
>  - complementary -> supplementary
>  - manual (iptables-extensions)
> 
>  extensions/libxt_owner.c           | 24 +++++++++++++++++-------
>  extensions/libxt_owner.man         |  4 ++++
>  include/linux/netfilter/xt_owner.h |  7 ++++---
>  3 files changed, 25 insertions(+), 10 deletions(-)
> 
> diff --git a/extensions/libxt_owner.c b/extensions/libxt_owner.c
> index 87e4df31..1702b478 100644
> --- a/extensions/libxt_owner.c
> +++ b/extensions/libxt_owner.c
> @@ -56,6 +56,7 @@ enum {
>  	O_PROCESS,
>  	O_SESSION,
>  	O_COMM,
> +	O_SUPPL_GROUPS,
>  };
>  
>  static void owner_mt_help_v0(void)
> @@ -87,7 +88,8 @@ static void owner_mt_help(void)
>  "owner match options:\n"
>  "[!] --uid-owner userid[-userid]      Match local UID\n"
>  "[!] --gid-owner groupid[-groupid]    Match local GID\n"
> -"[!] --socket-exists                  Match if socket exists\n");
> +"[!] --socket-exists                  Match if socket exists\n"
> +"    --suppl-groups                   Also match supplementary groups set with --gid-owner\n");
>  }
>  
>  #define s struct ipt_owner_info
> @@ -131,6 +133,7 @@ static const struct xt_option_entry owner_mt_opts[] = {
>  	 .flags = XTOPT_INVERT},
>  	{.name = "socket-exists", .id = O_SOCK_EXISTS, .type = XTTYPE_NONE,
>  	 .flags = XTOPT_INVERT},
> +	{.name = "suppl-groups", .id = O_SUPPL_GROUPS, .type = XTTYPE_NONE},
>  	XTOPT_TABLEEND,
>  };
>  
> @@ -275,6 +278,11 @@ static void owner_mt_parse(struct xt_option_call *cb)
>  			info->invert |= XT_OWNER_SOCKET;
>  		info->match |= XT_OWNER_SOCKET;
>  		break;
> +	case O_SUPPL_GROUPS:
> +		if (!(info->match & XT_OWNER_GID))
> +			xtables_param_act(XTF_BAD_VALUE, "owner", "--suppl-groups", "you need to use --gid-owner first");
> +		info->match |= XT_OWNER_SUPPL_GROUPS;
> +		break;
>  	}
>  }
>  
> @@ -455,9 +463,10 @@ static void owner_mt_print(const void *ip, const struct xt_entry_match *match,
>  {
>  	const struct xt_owner_match_info *info = (void *)match->data;
>  
> -	owner_mt_print_item(info, "owner socket exists", XT_OWNER_SOCKET, numeric);
> -	owner_mt_print_item(info, "owner UID match",     XT_OWNER_UID,    numeric);
> -	owner_mt_print_item(info, "owner GID match",     XT_OWNER_GID,    numeric);
> +	owner_mt_print_item(info, "owner socket exists", XT_OWNER_SOCKET,       numeric);
> +	owner_mt_print_item(info, "owner UID match",     XT_OWNER_UID,          numeric);
> +	owner_mt_print_item(info, "owner GID match",     XT_OWNER_GID,          numeric);
> +	owner_mt_print_item(info, "incl. suppl. groups", XT_OWNER_SUPPL_GROUPS, numeric);
>  }
>  
>  static void
> @@ -487,9 +496,10 @@ static void owner_mt_save(const void *ip, const struct xt_entry_match *match)
>  {
>  	const struct xt_owner_match_info *info = (void *)match->data;
>  
> -	owner_mt_print_item(info, "--socket-exists",  XT_OWNER_SOCKET, true);
> -	owner_mt_print_item(info, "--uid-owner",      XT_OWNER_UID,    true);
> -	owner_mt_print_item(info, "--gid-owner",      XT_OWNER_GID,    true);
> +	owner_mt_print_item(info, "--socket-exists",  XT_OWNER_SOCKET,       true);
> +	owner_mt_print_item(info, "--uid-owner",      XT_OWNER_UID,          true);
> +	owner_mt_print_item(info, "--gid-owner",      XT_OWNER_GID,          true);
> +	owner_mt_print_item(info, "--suppl-groups",   XT_OWNER_SUPPL_GROUPS, true);
>  }
>  
>  static int
> diff --git a/extensions/libxt_owner.man b/extensions/libxt_owner.man
> index 49b58cee..e2479865 100644
> --- a/extensions/libxt_owner.man
> +++ b/extensions/libxt_owner.man
> @@ -15,5 +15,9 @@ given user. You may also specify a numerical UID, or an UID range.
>  Matches if the packet socket's file structure is owned by the given group.
>  You may also specify a numerical GID, or a GID range.
>  .TP
> +\fB\-\-suppl\-groups\fP
> +Causes group(s) specified with \fB\-\-gid-owner\fP to be also checked in the
> +supplementary groups of a process.
> +.TP
>  [\fB!\fP] \fB\-\-socket\-exists\fP
>  Matches if the packet is associated with a socket.
> diff --git a/include/linux/netfilter/xt_owner.h b/include/linux/netfilter/xt_owner.h
> index 20817617..e7731dcc 100644
> --- a/include/linux/netfilter/xt_owner.h
> +++ b/include/linux/netfilter/xt_owner.h
> @@ -4,9 +4,10 @@
>  #include <linux/types.h>
>  
>  enum {
> -	XT_OWNER_UID    = 1 << 0,
> -	XT_OWNER_GID    = 1 << 1,
> -	XT_OWNER_SOCKET = 1 << 2,
> +	XT_OWNER_UID          = 1 << 0,
> +	XT_OWNER_GID          = 1 << 1,
> +	XT_OWNER_SOCKET       = 1 << 2,
> +	XT_OWNER_SUPPL_GROUPS = 1 << 3,
>  };
>  
>  struct xt_owner_match_info {
> -- 
> 2.20.1
> 

^ permalink raw reply	[flat|nested] 2+ messages in thread
end of thread, other threads:[~2019-06-10 10:34 UTC | newest]

Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
     [not found] <CGME20190610094353eucas1p29eb71e82aa621c1e387513571a78710b@eucas1p2.samsung.com>
2019-06-10  9:42 ` [PATCH v4] extensions: libxt_owner: Add supplementary groups option Lukasz Pawelczyk
2019-06-10 10:34   ` Pablo Neira Ayuso

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).