From: Raul Rodrigo Segura Date: Tue, 24 May 2022 22:33:08 +0200 Subject: add suppl-groups flag --- extensions/libxt_owner.c | 24 +++++++++++++++++------- extensions/libxt_owner.man | 4 ++++ extensions/libxt_owner.t | 16 ++++++++++++++++ extensions/libxt_owner.txlate | 8 ++++++++ include/linux/netfilter/xt_owner.h | 7 ++++--- 5 files changed, 49 insertions(+), 10 deletions(-) create mode 100644 extensions/libxt_owner.t create mode 100644 extensions/libxt_owner.txlate diff --git a/extensions/libxt_owner.c b/extensions/libxt_owner.c index 87e4df3..1702b47 100644 --- a/extensions/libxt_owner.c +++ b/extensions/libxt_owner.c @@ -56,6 +56,7 @@ enum { O_PROCESS, O_SESSION, O_COMM, + O_SUPPL_GROUPS, }; static void owner_mt_help_v0(void) @@ -87,7 +88,8 @@ static void owner_mt_help(void) "owner match options:\n" "[!] --uid-owner userid[-userid] Match local UID\n" "[!] --gid-owner groupid[-groupid] Match local GID\n" -"[!] --socket-exists Match if socket exists\n"); +"[!] --socket-exists Match if socket exists\n" +" --suppl-groups Also match supplementary groups set with --gid-owner\n"); } #define s struct ipt_owner_info @@ -131,6 +133,7 @@ static const struct xt_option_entry owner_mt_opts[] = { .flags = XTOPT_INVERT}, {.name = "socket-exists", .id = O_SOCK_EXISTS, .type = XTTYPE_NONE, .flags = XTOPT_INVERT}, + {.name = "suppl-groups", .id = O_SUPPL_GROUPS, .type = XTTYPE_NONE}, XTOPT_TABLEEND, }; @@ -275,6 +278,11 @@ static void owner_mt_parse(struct xt_option_call *cb) info->invert |= XT_OWNER_SOCKET; info->match |= XT_OWNER_SOCKET; break; + case O_SUPPL_GROUPS: + if (!(info->match & XT_OWNER_GID)) + xtables_param_act(XTF_BAD_VALUE, "owner", "--suppl-groups", "you need to use --gid-owner first"); + info->match |= XT_OWNER_SUPPL_GROUPS; + break; } } @@ -455,9 +463,10 @@ static void owner_mt_print(const void *ip, const struct xt_entry_match *match, { const struct xt_owner_match_info *info = (void *)match->data; - owner_mt_print_item(info, "owner socket exists", XT_OWNER_SOCKET, numeric); - owner_mt_print_item(info, "owner UID match", XT_OWNER_UID, numeric); - owner_mt_print_item(info, "owner GID match", XT_OWNER_GID, numeric); + owner_mt_print_item(info, "owner socket exists", XT_OWNER_SOCKET, numeric); + owner_mt_print_item(info, "owner UID match", XT_OWNER_UID, numeric); + owner_mt_print_item(info, "owner GID match", XT_OWNER_GID, numeric); + owner_mt_print_item(info, "incl. suppl. groups", XT_OWNER_SUPPL_GROUPS, numeric); } static void @@ -487,9 +496,10 @@ static void owner_mt_save(const void *ip, const struct xt_entry_match *match) { const struct xt_owner_match_info *info = (void *)match->data; - owner_mt_print_item(info, "--socket-exists", XT_OWNER_SOCKET, true); - owner_mt_print_item(info, "--uid-owner", XT_OWNER_UID, true); - owner_mt_print_item(info, "--gid-owner", XT_OWNER_GID, true); + owner_mt_print_item(info, "--socket-exists", XT_OWNER_SOCKET, true); + owner_mt_print_item(info, "--uid-owner", XT_OWNER_UID, true); + owner_mt_print_item(info, "--gid-owner", XT_OWNER_GID, true); + owner_mt_print_item(info, "--suppl-groups", XT_OWNER_SUPPL_GROUPS, true); } static int diff --git a/extensions/libxt_owner.man b/extensions/libxt_owner.man index 49b58ce..e247986 100644 --- a/extensions/libxt_owner.man +++ b/extensions/libxt_owner.man @@ -15,5 +15,9 @@ given user. You may also specify a numerical UID, or an UID range. Matches if the packet socket's file structure is owned by the given group. You may also specify a numerical GID, or a GID range. .TP +\fB\-\-suppl\-groups\fP +Causes group(s) specified with \fB\-\-gid-owner\fP to be also checked in the +supplementary groups of a process. +.TP [\fB!\fP] \fB\-\-socket\-exists\fP Matches if the packet is associated with a socket. diff --git a/extensions/libxt_owner.t b/extensions/libxt_owner.t new file mode 100644 index 0000000..2779e5c --- /dev/null +++ b/extensions/libxt_owner.t @@ -0,0 +1,16 @@ +:OUTPUT,POSTROUTING +*mangle +-m owner --uid-owner root;-m owner --uid-owner 0;OK +-m owner --uid-owner 0-10;=;OK +-m owner --gid-owner root;-m owner --gid-owner 0;OK +-m owner --gid-owner 0-10;=;OK +-m owner --uid-owner root --gid-owner root;-m owner --uid-owner 0 --gid-owner 0;OK +-m owner --uid-owner 0-10 --gid-owner 0-10;=;OK +-m owner ! --uid-owner root;-m owner ! --uid-owner 0;OK +-m owner --socket-exists;=;OK +-m owner --gid-owner 0-10 --suppl-groups;=;OK +-m owner --suppl-groups --gid-owner 0-10;;FAIL +-m owner --gid-owner 0-10 ! --suppl-groups;;FAIL +-m owner --suppl-groups;;FAIL +:INPUT +-m owner --uid-owner root;;FAIL diff --git a/extensions/libxt_owner.txlate b/extensions/libxt_owner.txlate new file mode 100644 index 0000000..86fb058 --- /dev/null +++ b/extensions/libxt_owner.txlate @@ -0,0 +1,8 @@ +iptables-translate -t nat -A OUTPUT -p tcp --dport 80 -m owner --uid-owner root -j ACCEPT +nft add rule ip nat OUTPUT tcp dport 80 skuid 0 counter accept + +iptables-translate -t nat -A OUTPUT -p tcp --dport 80 -m owner --gid-owner 0-10 -j ACCEPT +nft add rule ip nat OUTPUT tcp dport 80 skgid 0-10 counter accept + +iptables-translate -t nat -A OUTPUT -p tcp --dport 80 -m owner ! --uid-owner 1000 -j ACCEPT +nft add rule ip nat OUTPUT tcp dport 80 skuid != 1000 counter accept diff --git a/include/linux/netfilter/xt_owner.h b/include/linux/netfilter/xt_owner.h index 2081761..e7731dc 100644 --- a/include/linux/netfilter/xt_owner.h +++ b/include/linux/netfilter/xt_owner.h @@ -4,9 +4,10 @@ #include enum { - XT_OWNER_UID = 1 << 0, - XT_OWNER_GID = 1 << 1, - XT_OWNER_SOCKET = 1 << 2, + XT_OWNER_UID = 1 << 0, + XT_OWNER_GID = 1 << 1, + XT_OWNER_SOCKET = 1 << 2, + XT_OWNER_SUPPL_GROUPS = 1 << 3, }; struct xt_owner_match_info {