From 0a731f0f25fa816b8ad3c93b84faaa26c4c975f6 Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Fri, 7 Jun 2019 16:37:30 +0200 Subject: [PATCH] netfilter: xt_owner: bail out with EINVAL in case of unsupported flags Reject flags that are not supported with EINVAL. Signed-off-by: Pablo Neira Ayuso [sw0312.kim: backport from mainline to apply supplementary groups on netfilter] Signed-off-by: Seung-Woo Kim Change-Id: I92f1bd37788cc71088112770bb1b4071dfe8f3fd --- include/uapi/linux/netfilter/xt_owner.h | 5 +++++ net/netfilter/xt_owner.c | 3 +++ 2 files changed, 8 insertions(+) diff --git a/include/uapi/linux/netfilter/xt_owner.h b/include/uapi/linux/netfilter/xt_owner.h index 9e98c09eda32..5108df4d0313 100644 --- a/include/uapi/linux/netfilter/xt_owner.h +++ b/include/uapi/linux/netfilter/xt_owner.h @@ -11,6 +11,11 @@ enum { XT_OWNER_SUPPL_GROUPS = 1 << 3, }; +#define XT_OWNER_MASK (XT_OWNER_UID | \ + XT_OWNER_GID | \ + XT_OWNER_SOCKET | \ + XT_OWNER_SUPPL_GROUPS) + struct xt_owner_match_info { __u32 uid_min, uid_max; __u32 gid_min, gid_max; diff --git a/net/netfilter/xt_owner.c b/net/netfilter/xt_owner.c index acff455a619b..67c761633a56 100644 --- a/net/netfilter/xt_owner.c +++ b/net/netfilter/xt_owner.c @@ -25,6 +25,9 @@ static int owner_check(const struct xt_mtchk_param *par) struct xt_owner_match_info *info = par->matchinfo; struct net *net = par->net; + if (info->match & ~XT_OWNER_MASK) + return -EINVAL; + /* Only allow the common case where the userns of the writer * matches the userns of the network namespace. */ -- 2.34.1