iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

netfilter: xt_owner: bail out with EINVAL in case of unsupported flags

Browse Source 
Reject flags that are not supported with EINVAL.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Pablo Neira Ayuso 2019-06-07 16:37:30 +02:00
parent 87e389b4c2
commit 9911c1139f
2 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
include/uapi/linux/netfilter/xt_owner.h
View File

@ -11,6 +11,11 @@ enum {
XT_OWNER_SUPPL_GROUPS = 1 << 3,
};
#define XT_OWNER_MASK (XT_OWNER_UID | \
XT_OWNER_GID | \
XT_OWNER_SOCKET | \
XT_OWNER_SUPPL_GROUPS)
struct xt_owner_match_info {
__u32 uid_min, uid_max;
__u32 gid_min, gid_max;

3
net/netfilter/xt_owner.c
View File

@ -25,6 +25,9 @@ static int owner_check(const struct xt_mtchk_param *par)
struct xt_owner_match_info *info = par->matchinfo;
struct net *net = par->net;
if (info->match & ~XT_OWNER_MASK)
return -EINVAL;
/* Only allow the common case where the userns of the writer
* matches the userns of the network namespace.
*/