diff options
| author | Pablo Neira Ayuso <pablo@netfilter.org> | 2019-06-07 16:37:30 +0200 |
|---|---|---|
| committer | Seung-Woo Kim <sw0312.kim@samsung.com> | 2019-07-03 18:49:24 +0900 |
| commit | 7e4ea8b2b5aa9e6ac29345b595d46e1c9b9d6c0a (patch) | |
| tree | 4ce98d40cea82ca7b0f715937379f71f363e9daf | |
| parent | d6e85dccbddff65ca1a45ad71ff2fba6a89b2b6b (diff) | |
| download | linux-4.9-exynos9110-7e4ea8b2b5aa9e6ac29345b595d46e1c9b9d6c0a.tar.gz linux-4.9-exynos9110-7e4ea8b2b5aa9e6ac29345b595d46e1c9b9d6c0a.tar.bz2 linux-4.9-exynos9110-7e4ea8b2b5aa9e6ac29345b595d46e1c9b9d6c0a.zip | |
netfilter: xt_owner: bail out with EINVAL in case of unsupported flagssubmit/tizen/20190705.061120accepted/tizen/unified/20190705.110614
Reject flags that are not supported with EINVAL.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
[sw0312.kim: backport from mainline to support supplementary groups on netfilter]
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
Change-Id: I178cb193c6593b40d004e3110e512fcd5627d125
| -rw-r--r-- | include/uapi/linux/netfilter/xt_owner.h | 5 | ||||
| -rw-r--r-- | net/netfilter/xt_owner.c | 3 |
2 files changed, 8 insertions, 0 deletions
diff --git a/include/uapi/linux/netfilter/xt_owner.h b/include/uapi/linux/netfilter/xt_owner.h index e7731dcc51f4..e5c670da2464 100644 --- a/include/uapi/linux/netfilter/xt_owner.h +++ b/include/uapi/linux/netfilter/xt_owner.h @@ -10,6 +10,11 @@ enum { XT_OWNER_SUPPL_GROUPS = 1 << 3, }; +#define XT_OWNER_MASK (XT_OWNER_UID | \ + XT_OWNER_GID | \ + XT_OWNER_SOCKET | \ + XT_OWNER_SUPPL_GROUPS) + struct xt_owner_match_info { __u32 uid_min, uid_max; __u32 gid_min, gid_max; diff --git a/net/netfilter/xt_owner.c b/net/netfilter/xt_owner.c index 018d8ace3687..53bd659f3867 100644 --- a/net/netfilter/xt_owner.c +++ b/net/netfilter/xt_owner.c @@ -23,6 +23,9 @@ static int owner_check(const struct xt_mtchk_param *par) struct xt_owner_match_info *info = par->matchinfo; struct net *net = par->net; + if (info->match & ~XT_OWNER_MASK) + return -EINVAL; + /* Only allow the common case where the userns of the writer * matches the userns of the network namespace. */ |