extensions: libxt_owner: Add supplementary groups option

The --suppl-groups option causes GIDs specified with --gid-owner to be
also checked in the supplementary groups of a process.

Signed-off-by: Lukasz Pawelczyk <l.pawelczyk@samsung.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/extensions/libxt_owner.c b/extensions/libxt_owner.c
index 87e4df31256668c2f73688be2d4cc451ee038586..1702b47888725d7bb27c239cd1822d79a681b8ba 100644 (file)
--- a/extensions/libxt_owner.c
+++ b/extensions/libxt_owner.c
@@ -56,6 +56,7 @@ enum {
        O_PROCESS,
        O_SESSION,
        O_COMM,
+       O_SUPPL_GROUPS,
 };
 
 static void owner_mt_help_v0(void)
@@ -87,7 +88,8 @@ static void owner_mt_help(void)
 "owner match options:\n"
 "[!] --uid-owner userid[-userid]      Match local UID\n"
 "[!] --gid-owner groupid[-groupid]    Match local GID\n"
-"[!] --socket-exists                  Match if socket exists\n");
+"[!] --socket-exists                  Match if socket exists\n"
+"    --suppl-groups                   Also match supplementary groups set with --gid-owner\n");
 }
 
 #define s struct ipt_owner_info
@@ -131,6 +133,7 @@ static const struct xt_option_entry owner_mt_opts[] = {
         .flags = XTOPT_INVERT},
        {.name = "socket-exists", .id = O_SOCK_EXISTS, .type = XTTYPE_NONE,
         .flags = XTOPT_INVERT},
+       {.name = "suppl-groups", .id = O_SUPPL_GROUPS, .type = XTTYPE_NONE},
        XTOPT_TABLEEND,
 };
 
@@ -275,6 +278,11 @@ static void owner_mt_parse(struct xt_option_call *cb)
                        info->invert |= XT_OWNER_SOCKET;
                info->match |= XT_OWNER_SOCKET;
                break;
+       case O_SUPPL_GROUPS:
+               if (!(info->match & XT_OWNER_GID))
+                       xtables_param_act(XTF_BAD_VALUE, "owner", "--suppl-groups", "you need to use --gid-owner first");
+               info->match |= XT_OWNER_SUPPL_GROUPS;
+               break;
        }
 }
 
@@ -455,9 +463,10 @@ static void owner_mt_print(const void *ip, const struct xt_entry_match *match,
 {
        const struct xt_owner_match_info *info = (void *)match->data;
 
-       owner_mt_print_item(info, "owner socket exists", XT_OWNER_SOCKET, numeric);
-       owner_mt_print_item(info, "owner UID match",     XT_OWNER_UID,    numeric);
-       owner_mt_print_item(info, "owner GID match",     XT_OWNER_GID,    numeric);
+       owner_mt_print_item(info, "owner socket exists", XT_OWNER_SOCKET,       numeric);
+       owner_mt_print_item(info, "owner UID match",     XT_OWNER_UID,          numeric);
+       owner_mt_print_item(info, "owner GID match",     XT_OWNER_GID,          numeric);
+       owner_mt_print_item(info, "incl. suppl. groups", XT_OWNER_SUPPL_GROUPS, numeric);
 }
 
 static void
@@ -487,9 +496,10 @@ static void owner_mt_save(const void *ip, const struct xt_entry_match *match)
 {
        const struct xt_owner_match_info *info = (void *)match->data;
 
-       owner_mt_print_item(info, "--socket-exists",  XT_OWNER_SOCKET, true);
-       owner_mt_print_item(info, "--uid-owner",      XT_OWNER_UID,    true);
-       owner_mt_print_item(info, "--gid-owner",      XT_OWNER_GID,    true);
+       owner_mt_print_item(info, "--socket-exists",  XT_OWNER_SOCKET,       true);
+       owner_mt_print_item(info, "--uid-owner",      XT_OWNER_UID,          true);
+       owner_mt_print_item(info, "--gid-owner",      XT_OWNER_GID,          true);
+       owner_mt_print_item(info, "--suppl-groups",   XT_OWNER_SUPPL_GROUPS, true);
 }
 
 static int

diff --git a/extensions/libxt_owner.man b/extensions/libxt_owner.man
index 49b58ceef738e88d6a50452b46e338a056701d26..e2479865651187bb82eab65041f471a74f55ee60 100644 (file)
--- a/extensions/libxt_owner.man
+++ b/extensions/libxt_owner.man
@@ -15,5 +15,9 @@ given user. You may also specify a numerical UID, or an UID range.
 Matches if the packet socket's file structure is owned by the given group.
 You may also specify a numerical GID, or a GID range.
 .TP
+\fB\-\-suppl\-groups\fP
+Causes group(s) specified with \fB\-\-gid-owner\fP to be also checked in the
+supplementary groups of a process.
+.TP
 [\fB!\fP] \fB\-\-socket\-exists\fP
 Matches if the packet is associated with a socket.

diff --git a/extensions/libxt_owner.t b/extensions/libxt_owner.t
index aec30b655e9a50537cec02d9ad745a78f52b6e5a..2779e5c1c24cb88c29b0728c307ce24090447774 100644 (file)
--- a/extensions/libxt_owner.t
+++ b/extensions/libxt_owner.t
@@ -8,5 +8,9 @@
 -m owner --uid-owner 0-10 --gid-owner 0-10;=;OK
 -m owner ! --uid-owner root;-m owner ! --uid-owner 0;OK
 -m owner --socket-exists;=;OK
+-m owner --gid-owner 0-10 --suppl-groups;=;OK
+-m owner --suppl-groups --gid-owner 0-10;;FAIL
+-m owner --gid-owner 0-10 ! --suppl-groups;;FAIL
+-m owner --suppl-groups;;FAIL
 :INPUT
 -m owner --uid-owner root;;FAIL

diff --git a/include/linux/netfilter/xt_owner.h b/include/linux/netfilter/xt_owner.h
index 2081761714b56cba415b413f7801ef113230407a..e7731dcc51f46f49f427ee4539b6c2259c915a4e 100644 (file)
--- a/include/linux/netfilter/xt_owner.h
+++ b/include/linux/netfilter/xt_owner.h
@@ -4,9 +4,10 @@
 #include <linux/types.h>
 
 enum {
-       XT_OWNER_UID    = 1 << 0,
-       XT_OWNER_GID    = 1 << 1,
-       XT_OWNER_SOCKET = 1 << 2,
+       XT_OWNER_UID          = 1 << 0,
+       XT_OWNER_GID          = 1 << 1,
+       XT_OWNER_SOCKET       = 1 << 2,
+       XT_OWNER_SUPPL_GROUPS = 1 << 3,
 };
 
 struct xt_owner_match_info {