On Mon, Jun 10, 2019 at 11:42:38AM +0200, Lukasz Pawelczyk wrote:
> The --suppl-groups option causes GIDs specified with --gid-owner to be
> also checked in the supplementary groups of a process.
Could you also extend iptables/extensions/libxt_owner.t ?
Thanks.
> Signed-off-by: Lukasz Pawelczyk <l.pawelczyk@xxxxxxxxxxx>
> ---
>
> Changes from v3:
> - removed XTOPT_INVERT from O_SUPPL_GROUPS,
> it wasn't meant to be invertable
>
> Changes from v2:
> - XT_SUPPL_GROUPS -> XT_OWNER_SUPPL_GROUPS
>
> Changes from v1:
> - complementary -> supplementary
> - manual (iptables-extensions)
>
> extensions/libxt_owner.c | 24 +++++++++++++++++-------
> extensions/libxt_owner.man | 4 ++++
> include/linux/netfilter/xt_owner.h | 7 ++++---
> 3 files changed, 25 insertions(+), 10 deletions(-)
>
> diff --git a/extensions/libxt_owner.c b/extensions/libxt_owner.c
> index 87e4df31..1702b478 100644
> --- a/extensions/libxt_owner.c
> +++ b/extensions/libxt_owner.c
> @@ -56,6 +56,7 @@ enum {
> O_PROCESS,
> O_SESSION,
> O_COMM,
> + O_SUPPL_GROUPS,
> };
>
> static void owner_mt_help_v0(void)
> @@ -87,7 +88,8 @@ static void owner_mt_help(void)
> "owner match options:\n"
> "[!] --uid-owner userid[-userid] Match local UID\n"
> "[!] --gid-owner groupid[-groupid] Match local GID\n"
> -"[!] --socket-exists Match if socket exists\n");
> +"[!] --socket-exists Match if socket exists\n"
> +" --suppl-groups Also match supplementary groups set with --gid-owner\n");
> }
>
> #define s struct ipt_owner_info
> @@ -131,6 +133,7 @@ static const struct xt_option_entry owner_mt_opts[] = {
> .flags = XTOPT_INVERT},
> {.name = "socket-exists", .id = O_SOCK_EXISTS, .type = XTTYPE_NONE,
> .flags = XTOPT_INVERT},
> + {.name = "suppl-groups", .id = O_SUPPL_GROUPS, .type = XTTYPE_NONE},
> XTOPT_TABLEEND,
> };
>
> @@ -275,6 +278,11 @@ static void owner_mt_parse(struct xt_option_call *cb)
> info->invert |= XT_OWNER_SOCKET;
> info->match |= XT_OWNER_SOCKET;
> break;
> + case O_SUPPL_GROUPS:
> + if (!(info->match & XT_OWNER_GID))
> + xtables_param_act(XTF_BAD_VALUE, "owner", "--suppl-groups", "you need to use --gid-owner first");
> + info->match |= XT_OWNER_SUPPL_GROUPS;
> + break;
> }
> }
>
> @@ -455,9 +463,10 @@ static void owner_mt_print(const void *ip, const struct xt_entry_match *match,
> {
> const struct xt_owner_match_info *info = (void *)match->data;
>
> - owner_mt_print_item(info, "owner socket exists", XT_OWNER_SOCKET, numeric);
> - owner_mt_print_item(info, "owner UID match", XT_OWNER_UID, numeric);
> - owner_mt_print_item(info, "owner GID match", XT_OWNER_GID, numeric);
> + owner_mt_print_item(info, "owner socket exists", XT_OWNER_SOCKET, numeric);
> + owner_mt_print_item(info, "owner UID match", XT_OWNER_UID, numeric);
> + owner_mt_print_item(info, "owner GID match", XT_OWNER_GID, numeric);
> + owner_mt_print_item(info, "incl. suppl. groups", XT_OWNER_SUPPL_GROUPS, numeric);
> }
>
> static void
> @@ -487,9 +496,10 @@ static void owner_mt_save(const void *ip, const struct xt_entry_match *match)
> {
> const struct xt_owner_match_info *info = (void *)match->data;
>
> - owner_mt_print_item(info, "--socket-exists", XT_OWNER_SOCKET, true);
> - owner_mt_print_item(info, "--uid-owner", XT_OWNER_UID, true);
> - owner_mt_print_item(info, "--gid-owner", XT_OWNER_GID, true);
> + owner_mt_print_item(info, "--socket-exists", XT_OWNER_SOCKET, true);
> + owner_mt_print_item(info, "--uid-owner", XT_OWNER_UID, true);
> + owner_mt_print_item(info, "--gid-owner", XT_OWNER_GID, true);
> + owner_mt_print_item(info, "--suppl-groups", XT_OWNER_SUPPL_GROUPS, true);
> }
>
> static int
> diff --git a/extensions/libxt_owner.man b/extensions/libxt_owner.man
> index 49b58cee..e2479865 100644
> --- a/extensions/libxt_owner.man
> +++ b/extensions/libxt_owner.man
> @@ -15,5 +15,9 @@ given user. You may also specify a numerical UID, or an UID range.
> Matches if the packet socket's file structure is owned by the given group.
> You may also specify a numerical GID, or a GID range.
> .TP
> +\fB\-\-suppl\-groups\fP
> +Causes group(s) specified with \fB\-\-gid-owner\fP to be also checked in the
> +supplementary groups of a process.
> +.TP
> [\fB!\fP] \fB\-\-socket\-exists\fP
> Matches if the packet is associated with a socket.
> diff --git a/include/linux/netfilter/xt_owner.h b/include/linux/netfilter/xt_owner.h
> index 20817617..e7731dcc 100644
> --- a/include/linux/netfilter/xt_owner.h
> +++ b/include/linux/netfilter/xt_owner.h
> @@ -4,9 +4,10 @@
> #include <linux/types.h>
>
> enum {
> - XT_OWNER_UID = 1 << 0,
> - XT_OWNER_GID = 1 << 1,
> - XT_OWNER_SOCKET = 1 << 2,
> + XT_OWNER_UID = 1 << 0,
> + XT_OWNER_GID = 1 << 1,
> + XT_OWNER_SOCKET = 1 << 2,
> + XT_OWNER_SUPPL_GROUPS = 1 << 3,
> };
>
> struct xt_owner_match_info {
> --
> 2.20.1
>
