Doug / smarc-fsl-linux-kernel

Download as
Browse Code ยป

Commit da7428080a15189c7acd266d514324f2a2e89e14

Authored by Eric W. Biederman
1 parent 8c6e2a941a
Exists in smarc-l5.0.0_1.0.0-ga and in 5 other branches imx_3.10.17_1.0.1_ga, imx_3.10.53_1.1.0_ga, imx_3.14.28_1.0.0_ga, smarc-imx_3.10.53_1.1.0_ga, smarc-imx_3.14.28_1.0.0_ga

userns xt_recent: Specify the owner/group of ip_list_perms in the initial user namespace 

xt_recent creates a bunch of proc files and initializes their uid
and gids to the values of ip_list_uid and ip_list_gid.  When
initialize those proc files convert those values to kuids so they
can continue to reside on the /proc inode.

Cc: Pablo Neira Ayuso <pablo@netfilter.org>
Cc: Patrick McHardy <kaber@trash.net>
Cc: Jan Engelhardt <jengelh@medozas.de>
Acked-by: David S. Miller <davem@davemloft.net>
Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>

Showing 2 changed files with 11 additions and 3 deletions Side-by-side Diff

... ... @@ -944,7 +944,6 @@
944 944 # Networking
945 945 depends on NET_9P = n
946 946 depends on NETFILTER_XT_MATCH_OWNER = n
947   - depends on NETFILTER_XT_MATCH_RECENT = n
948 947 depends on AF_RXRPC = n
949 948 depends on NET_KEY = n
950 949 depends on DNS_RESOLVER = n
net/netfilter/xt_recent.c
Diff comments   View file @ da74280
... ... @@ -317,6 +317,8 @@
317 317 struct recent_table *t;
318 318 #ifdef CONFIG_PROC_FS
319 319 struct proc_dir_entry *pde;
  320 + kuid_t uid;
  321 + kgid_t gid;
320 322 #endif
321 323 unsigned int i;
322 324 int ret = -EINVAL;
... ... @@ -372,6 +374,13 @@
372 374 for (i = 0; i < ip_list_hash_size; i++)
373 375 INIT_LIST_HEAD(&t->iphash[i]);
374 376 #ifdef CONFIG_PROC_FS
  377 + uid = make_kuid(&init_user_ns, ip_list_uid);
  378 + gid = make_kgid(&init_user_ns, ip_list_gid);
  379 + if (!uid_valid(uid) || !gid_valid(gid)) {
  380 + kfree(t);
  381 + ret = -EINVAL;
  382 + goto out;
  383 + }
375 384 pde = proc_create_data(t->name, ip_list_perms, recent_net->xt_recent,
376 385 &recent_mt_fops, t);
377 386 if (pde == NULL) {
... ... @@ -379,8 +388,8 @@
379 388 ret = -ENOMEM;
380 389 goto out;
381 390 }
382   - pde->uid = ip_list_uid;
383   - pde->gid = ip_list_gid;
  391 + pde->uid = uid;
  392 + pde->gid = gid;
384 393 #endif
385 394 spin_lock_bh(&recent_lock);
386 395 list_add_tail(&t->list, &recent_net->tables);