Commit 8c6e2a94 authored by Eric W. Biederman's avatar Eric W. Biederman

userns: Convert xt_LOG to print socket kuids and kgids as uids and gids

xt_LOG always writes messages via sb_add via printk.  Therefore when
xt_LOG logs the uid and gid of a socket a packet came from the
values should be converted to be in the initial user namespace.

Thus making xt_LOG as user namespace safe as possible.

Cc: Pablo Neira Ayuso <pablo@netfilter.org>
Cc: Patrick McHardy <kaber@trash.net>
Acked-by: default avatarDavid S. Miller <davem@davemloft.net>
Acked-by: default avatarSerge Hallyn <serge.hallyn@canonical.com>
Signed-off-by: default avatarEric W. Biederman <ebiederm@xmission.com>
parent a6c6796c
...@@ -945,7 +945,6 @@ config UIDGID_CONVERTED ...@@ -945,7 +945,6 @@ config UIDGID_CONVERTED
depends on NET_9P = n depends on NET_9P = n
depends on NETFILTER_XT_MATCH_OWNER = n depends on NETFILTER_XT_MATCH_OWNER = n
depends on NETFILTER_XT_MATCH_RECENT = n depends on NETFILTER_XT_MATCH_RECENT = n
depends on NETFILTER_XT_TARGET_LOG = n
depends on AF_RXRPC = n depends on AF_RXRPC = n
depends on NET_KEY = n depends on NET_KEY = n
depends on DNS_RESOLVER = n depends on DNS_RESOLVER = n
......
...@@ -363,10 +363,12 @@ static void dump_ipv4_packet(struct sbuff *m, ...@@ -363,10 +363,12 @@ static void dump_ipv4_packet(struct sbuff *m,
/* Max length: 15 "UID=4294967295 " */ /* Max length: 15 "UID=4294967295 " */
if ((logflags & XT_LOG_UID) && !iphoff && skb->sk) { if ((logflags & XT_LOG_UID) && !iphoff && skb->sk) {
read_lock_bh(&skb->sk->sk_callback_lock); read_lock_bh(&skb->sk->sk_callback_lock);
if (skb->sk->sk_socket && skb->sk->sk_socket->file) if (skb->sk->sk_socket && skb->sk->sk_socket->file) {
const struct cred *cred = skb->sk->sk_socket->file->f_cred;
sb_add(m, "UID=%u GID=%u ", sb_add(m, "UID=%u GID=%u ",
skb->sk->sk_socket->file->f_cred->fsuid, from_kuid_munged(&init_user_ns, cred->fsuid),
skb->sk->sk_socket->file->f_cred->fsgid); from_kgid_munged(&init_user_ns, cred->fsgid));
}
read_unlock_bh(&skb->sk->sk_callback_lock); read_unlock_bh(&skb->sk->sk_callback_lock);
} }
...@@ -719,10 +721,12 @@ static void dump_ipv6_packet(struct sbuff *m, ...@@ -719,10 +721,12 @@ static void dump_ipv6_packet(struct sbuff *m,
/* Max length: 15 "UID=4294967295 " */ /* Max length: 15 "UID=4294967295 " */
if ((logflags & XT_LOG_UID) && recurse && skb->sk) { if ((logflags & XT_LOG_UID) && recurse && skb->sk) {
read_lock_bh(&skb->sk->sk_callback_lock); read_lock_bh(&skb->sk->sk_callback_lock);
if (skb->sk->sk_socket && skb->sk->sk_socket->file) if (skb->sk->sk_socket && skb->sk->sk_socket->file) {
const struct cred *cred = skb->sk->sk_socket->file->f_cred;
sb_add(m, "UID=%u GID=%u ", sb_add(m, "UID=%u GID=%u ",
skb->sk->sk_socket->file->f_cred->fsuid, from_kuid_munged(&init_user_ns, cred->fsuid),
skb->sk->sk_socket->file->f_cred->fsgid); from_kgid_munged(&init_user_ns, cred->fsgid));
}
read_unlock_bh(&skb->sk->sk_callback_lock); read_unlock_bh(&skb->sk->sk_callback_lock);
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment