diff options
| author | Pablo Neira Ayuso <pablo@netfilter.org> | 2019-06-07 16:37:30 +0200 |
|---|---|---|
| committer | Seung-Woo Kim <sw0312.kim@samsung.com> | 2019-07-05 15:23:06 +0900 |
| commit | 957021d33261d054781731392e4ea8b564f6a353 (patch) | |
| tree | 679fcbf3b077240e6035662845e549adfe8f9367 | |
| parent | 8413c52116d57850c75e7ef04f4a37cab878cc6f (diff) | |
| download | linux-artik7-957021d33261d054781731392e4ea8b564f6a353.tar.gz linux-artik7-957021d33261d054781731392e4ea8b564f6a353.tar.bz2 linux-artik7-957021d33261d054781731392e4ea8b564f6a353.zip | |
netfilter: xt_owner: bail out with EINVAL in case of unsupported flagssubmit/tizen/20190705.061120accepted/tizen/unified/20190705.110618
Reject flags that are not supported with EINVAL.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
[sw0312.kim: backport from mainline to apply supplementary groups on netfilter]
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
Change-Id: I129a3a1fc8f54d5e4f0ae164e0036bad7cd67c64
| -rw-r--r-- | include/uapi/linux/netfilter/xt_owner.h | 5 | ||||
| -rw-r--r-- | net/netfilter/xt_owner.c | 3 |
2 files changed, 8 insertions, 0 deletions
diff --git a/include/uapi/linux/netfilter/xt_owner.h b/include/uapi/linux/netfilter/xt_owner.h index e7731dcc51f4..e5c670da2464 100644 --- a/include/uapi/linux/netfilter/xt_owner.h +++ b/include/uapi/linux/netfilter/xt_owner.h @@ -10,6 +10,11 @@ enum { XT_OWNER_SUPPL_GROUPS = 1 << 3, }; +#define XT_OWNER_MASK (XT_OWNER_UID | \ + XT_OWNER_GID | \ + XT_OWNER_SOCKET | \ + XT_OWNER_SUPPL_GROUPS) + struct xt_owner_match_info { __u32 uid_min, uid_max; __u32 gid_min, gid_max; diff --git a/net/netfilter/xt_owner.c b/net/netfilter/xt_owner.c index 6423e48c88b1..7305492b22ad 100644 --- a/net/netfilter/xt_owner.c +++ b/net/netfilter/xt_owner.c @@ -22,6 +22,9 @@ static int owner_check(const struct xt_mtchk_param *par) { struct xt_owner_match_info *info = par->matchinfo; + if (info->match & ~XT_OWNER_MASK) + return -EINVAL; + /* For now only allow adding matches from the initial user namespace */ if ((info->match & (XT_OWNER_UID|XT_OWNER_GID)) && (current_user_ns() != &init_user_ns)) |