Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8c6e2a94 authored by Eric W. Biederman's avatar Eric W. Biederman
Browse files

userns: Convert xt_LOG to print socket kuids and kgids as uids and gids 



xt_LOG always writes messages via sb_add via printk.  Therefore when
xt_LOG logs the uid and gid of a socket a packet came from the
values should be converted to be in the initial user namespace.

Thus making xt_LOG as user namespace safe as possible.

Cc: Pablo Neira Ayuso <pablo@netfilter.org>
Cc: Patrick McHardy <kaber@trash.net>
Acked-by: default avatarDavid S. Miller <davem@davemloft.net>
Acked-by: default avatarSerge Hallyn <serge.hallyn@canonical.com>
Signed-off-by: default avatarEric W. Biederman <ebiederm@xmission.com>
parent a6c6796c

init/Kconfig

+0 −1
Original line number Diff line number Diff line
@@ -945,7 +945,6 @@ config UIDGID_CONVERTED 
	depends on NET_9P = n

	depends on NETFILTER_XT_MATCH_OWNER = n

	depends on NETFILTER_XT_MATCH_RECENT = n

	depends on NETFILTER_XT_TARGET_LOG = n

	depends on AF_RXRPC = n

	depends on NET_KEY = n

	depends on DNS_RESOLVER = n

net/netfilter/xt_LOG.c

+10 −6
Original line number Diff line number Diff line
@@ -363,10 +363,12 @@ static void dump_ipv4_packet(struct sbuff *m, 
	/* Max length: 15 "UID=4294967295 " */

	if ((logflags & XT_LOG_UID) && !iphoff && skb->sk) {

		read_lock_bh(&skb->sk->sk_callback_lock);

		if (skb->sk->sk_socket && skb->sk->sk_socket->file)

		if (skb->sk->sk_socket && skb->sk->sk_socket->file) {

			const struct cred *cred = skb->sk->sk_socket->file->f_cred;

			sb_add(m, "UID=%u GID=%u ",

				skb->sk->sk_socket->file->f_cred->fsuid,

				skb->sk->sk_socket->file->f_cred->fsgid);

				from_kuid_munged(&init_user_ns, cred->fsuid),

				from_kgid_munged(&init_user_ns, cred->fsgid));

		}

		read_unlock_bh(&skb->sk->sk_callback_lock);

	}
@@ -719,10 +721,12 @@ static void dump_ipv6_packet(struct sbuff *m, 
	/* Max length: 15 "UID=4294967295 " */

	if ((logflags & XT_LOG_UID) && recurse && skb->sk) {

		read_lock_bh(&skb->sk->sk_callback_lock);

		if (skb->sk->sk_socket && skb->sk->sk_socket->file)

		if (skb->sk->sk_socket && skb->sk->sk_socket->file) {

			const struct cred *cred = skb->sk->sk_socket->file->f_cred;

			sb_add(m, "UID=%u GID=%u ",

				skb->sk->sk_socket->file->f_cred->fsuid,

				skb->sk->sk_socket->file->f_cred->fsgid);

				from_kuid_munged(&init_user_ns, cred->fsuid),

				from_kgid_munged(&init_user_ns, cred->fsgid));

		}

		read_unlock_bh(&skb->sk->sk_callback_lock);

	}