From 757f9183652ee6738ce1476db11595775f2ae251 Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Fri, 7 Jun 2019 16:37:30 +0200 Subject: [PATCH] netfilter: xt_owner: bail out with EINVAL in case of unsupported flags Reject flags that are not supported with EINVAL. Signed-off-by: Pablo Neira Ayuso [sw0312.kim: backport from mainline to apply supplementary groups on netfilter] Signed-off-by: Seung-Woo Kim Change-Id: I2ab809e6b7e3823e3fd3af053348dac9af009cca --- include/uapi/linux/netfilter/xt_owner.h | 5 +++++ net/netfilter/xt_owner.c | 3 +++ 2 files changed, 8 insertions(+) diff --git a/include/uapi/linux/netfilter/xt_owner.h b/include/uapi/linux/netfilter/xt_owner.h index e7731dcc51f..e5c670da246 100644 --- a/include/uapi/linux/netfilter/xt_owner.h +++ b/include/uapi/linux/netfilter/xt_owner.h @@ -10,6 +10,11 @@ enum { XT_OWNER_SUPPL_GROUPS = 1 << 3, }; +#define XT_OWNER_MASK (XT_OWNER_UID | \ + XT_OWNER_GID | \ + XT_OWNER_SOCKET | \ + XT_OWNER_SUPPL_GROUPS) + struct xt_owner_match_info { __u32 uid_min, uid_max; __u32 gid_min, gid_max; diff --git a/net/netfilter/xt_owner.c b/net/netfilter/xt_owner.c index 5b21999a5b5..2289544b160 100644 --- a/net/netfilter/xt_owner.c +++ b/net/netfilter/xt_owner.c @@ -21,6 +21,9 @@ static int owner_check(const struct xt_mtchk_param *par) { struct xt_owner_match_info *info = par->matchinfo; + if (info->match & ~XT_OWNER_MASK) + return -EINVAL; + /* For now only allow adding matches from the initial user namespace */ if ((info->match & (XT_OWNER_UID|XT_OWNER_GID)) && (current_user_ns() != &init_user_ns)) -- 2.34.1