Reject flags that are not supported with EINVAL.
Signed-off-by: Pablo Neira Ayuso <[email protected]>
---
A bit late for ea6cc2fd8a2b ("netfilter: xt_owner: Add supplementary
groups option"). Old kernel will ignore this new flag, so better bail
out for future flags. We can also request a backport to be send to
-stable kernels to deal with this new supplementary group support.
Otherwise, we have to go for a new revision.
include/uapi/linux/netfilter/xt_owner.h | 5 +++++
net/netfilter/xt_owner.c | 3 +++
2 files changed, 8 insertions(+)
diff --git a/include/uapi/linux/netfilter/xt_owner.h
b/include/uapi/linux/netfilter/xt_owner.h
index 9e98c09eda32..5108df4d0313 100644
--- a/include/uapi/linux/netfilter/xt_owner.h
+++ b/include/uapi/linux/netfilter/xt_owner.h
@@ -11,6 +11,11 @@ enum {
XT_OWNER_SUPPL_GROUPS = 1 << 3,
};
+#define XT_OWNER_MASK (XT_OWNER_UID | \
+ XT_OWNER_GID | \
+ XT_OWNER_SOCKET | \
+ XT_OWNER_SUPPL_GROUPS)
+
struct xt_owner_match_info {
__u32 uid_min, uid_max;
__u32 gid_min, gid_max;
diff --git a/net/netfilter/xt_owner.c b/net/netfilter/xt_owner.c
index a8784502aca6..ee597fdc5db7 100644
--- a/net/netfilter/xt_owner.c
+++ b/net/netfilter/xt_owner.c
@@ -25,6 +25,9 @@ static int owner_check(const struct xt_mtchk_param *par)
struct xt_owner_match_info *info = par->matchinfo;
struct net *net = par->net;
+ if (info->match & ~XT_OWNER_MASK)
+ return -EINVAL;
+
/* Only allow the common case where the userns of the writer
* matches the userns of the network namespace.
*/
--
2.11.0
