ipt_recent: add module parameter for changing GID of /proc/net/ipt_recent/*

PATCH Applied Daniel De Graaf 2 participants 6 messages Jul 8, 2006 – Jul 9, 2006

Subsystems (2)

Networking netfilter

lore

Share & tools

lore

Daniel De Graaf

author

2006-07-08 01:46 UTC #0 lore raw

PATCH 1/1 ipt_recent: add module parameter for changing GID of /proc/net/ipt_recent/*

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

This patch adds an ip_list_gid module parameter to ipt_recent, which is meant to be used in combination with the ip_list_perms. In the current implementation, the files must either be world-writable or require programs which write to them to be (at least) setgid root.

- - Daniel De Graaf
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFErw5+Zz9quLVV3/MRAm89AKCLV3Q3GRXCd0g8NYd0mEbsQMKEhgCdF68k CdOSO/Sg0iHlKM6xVuXOIqg=
=sOWs
-----END PGP SIGNATURE-----

net/ipv4/netfilter/ipt_recent.c +4 -0

@@ -28,6 +28,7 @@
 static unsigned int ip_pkt_list_tot = 20;
 static unsigned int ip_list_hash_size = 0;
 static unsigned int ip_list_perms = 0644;
+static unsigned int ip_list_gid = 0;
 #ifdef DEBUG
 static int debug = 1;
 #endif

@@ -42,6 +43,7 @@
 module_param(ip_pkt_list_tot, uint, 0400);
 module_param(ip_list_hash_size, uint, 0400);
 module_param(ip_list_perms, uint, 0400);
+module_param(ip_list_gid, uint, 0400);
 #ifdef DEBUG
 module_param(debug, bool, 0600);
 MODULE_PARM_DESC(debug,"enable debugging output");

@@ -50,6 +52,7 @@
 MODULE_PARM_DESC(ip_pkt_list_tot,"number of packets per IP to remember");
 MODULE_PARM_DESC(ip_list_hash_size,"size of hash table used to look up IPs");
 MODULE_PARM_DESC(ip_list_perms,"permissions on /proc/net/ipt_recent/* files");
+MODULE_PARM_DESC(ip_list_gid,"owning group of /proc/net/ipt_recent/* files");
 
 /* Structure of our list of recently seen addresses. */
 struct recent_ip_list {

@@ -852,6 +855,7 @@
 	}
 	
 	curr_table->status_proc->owner = THIS_MODULE;
+	curr_table->status_proc->gid = ip_list_gid;
 	curr_table->status_proc->data = curr_table;
 	wmb();
 	curr_table->status_proc->read_proc = ip_recent_get_info;

Patrick McHardy

2006-07-08 03:02 UTC #1 lore raw

Quoted 6 lines · Daniel De Graaf

This patch adds an ip_list_gid module parameter to ipt_recent, which is meant to be used in combination with the ip_list_perms. In the current implementation, the files must either be world-writable or require programs which write to them to be (at least) setgid root.
- Daniel De Graaf

/* Structure of our list of recently seen addresses. */ struct recent_ip_list {
@@ -852,6 +855,7 @@
}

curr_table->status_proc->owner = THIS_MODULE;
+ curr_table->status_proc->gid = ip_list_gid;
curr_table->status_proc->data = curr_table; wmb();
curr_table->status_proc->read_proc = ip_recent_get_info;

That code is gone for good, please check if your patch is still necessary for current -git and resubmit in case it is.

Daniel De Graaf

author

2006-07-08 03:25 UTC #2 lore raw

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Quoted 17 lines · Patrick McHardy

Quoted 7 lines · Daniel De Graaf
This patch adds an ip_list_gid module parameter to ipt_recent, which is meant to be used in combination with the ip_list_perms. In the current implementation, the files must either be world-writable or require programs which write to them to be (at least) setgid root.
- Daniel De Graaf
/* Structure of our list of recently seen addresses. */ struct recent_ip_list { @@ -852,6 +855,7 @@ } curr_table->status_proc->owner = THIS_MODULE; + curr_table->status_proc->gid = ip_list_gid; curr_table->status_proc->data = curr_table; wmb(); curr_table->status_proc->read_proc = ip_recent_get_info;

Quoted 2 lines

That code is gone for good, please check if your patch is still necessary for current -git and resubmit in case it is.

Here's an updated patch against 2.6.18-rc1. -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFEryWfZz9quLVV3/MRAoFbAJ0bl5jhgADEm4ppII7etF4g4/Qc5ACfRtzQ 27lEptoQ9kHdv5XusVx7L1w=
=VJVi
-----END PGP SIGNATURE-----

ipt_recent.c renamed from ipt_recent.c.old +4 -0

@@ -35,14 +35,17 @@
 static unsigned int ip_pkt_list_tot = 20;
 static unsigned int ip_list_hash_size = 0;
 static unsigned int ip_list_perms = 0644;
+static unsigned int ip_list_gid = 0;
 module_param(ip_list_tot, uint, 0400);
 module_param(ip_pkt_list_tot, uint, 0400);
 module_param(ip_list_hash_size, uint, 0400);
 module_param(ip_list_perms, uint, 0400);
+module_param(ip_list_gid, uint, 0400);
 MODULE_PARM_DESC(ip_list_tot, "number of IPs to remember per list");
 MODULE_PARM_DESC(ip_pkt_list_tot, "number of packets per IP to remember (max. 255)");
 MODULE_PARM_DESC(ip_list_hash_size, "size of hash table used to look up IPs");
 MODULE_PARM_DESC(ip_list_perms, "permissions on /proc/net/ipt_recent/* files");
+MODULE_PARM_DESC(ip_list_gid,"owning group of /proc/net/ipt_recent/* files");
 
 
 struct recent_entry {

@@ -274,6 +277,7 @@
 		goto out;
 	}
 	t->proc->proc_fops = &recent_fops;
+	t->proc->gid       = ip_list_gid;
 	t->proc->data      = t;
 #endif
 	spin_lock_bh(&recent_lock);

Patrick McHardy

2006-07-08 10:42 UTC #3 lore raw

Quoted 11 lines · Daniel De Graaf

Quoted 8 lines · Patrick McHardy
Quoted 8 lines
Quoted 6 lines · Daniel De Graaf
This patch adds an ip_list_gid module parameter to ipt_recent, which is meant to be used in combination with the ip_list_perms. In the current implementation, the files must either be world-writable or require programs which write to them to be (at least) setgid root.
Here's an updated patch against 2.6.18-rc1.

I'm fine doing this, but just allowing to set group ownership without user ownership will probably soon make someone else send me a second patch, so please take care of this as well. Please also make sure your patch applies with -p1 in the kernel tree root and don't forget to sign off.

Daniel De Graaf

author

2006-07-08 17:21 UTC #4 lore raw

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Quoted 11 lines · Patrick McHardy

Quoted 10 lines · Daniel De Graaf
Quoted 8 lines · Patrick McHardy
Quoted 8 lines
Quoted 6 lines · Daniel De Graaf
This patch adds an ip_list_gid module parameter to ipt_recent, which is meant to be used in combination with the ip_list_perms. In the current implementation, the files must either be world-writable or require programs which write to them to be (at least) setgid root.

Quoted 9 lines

Quoted 1 line
Here's an updated patch against 2.6.18-rc1.
I'm fine doing this, but just allowing to set group ownership without user ownership will probably soon make someone else send me a second patch, so please take care of this as well. Please also make sure your patch applies with -p1 in the kernel tree root and don't forget to sign off.

Patch with UID setting and sign-off.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFEr+mnZz9quLVV3/MRAh+VAJ0a1oTXKgSPRhYK4tczTfQ7EV8LjQCgjyFN WSipG6xM0sS5TTNi40IuM5M=
=DKBS
-----END PGP SIGNATURE-----

Add support for setting the UID and GID of /proc/net/ipt_recent/* files.

Signed-off-by Daniel De Graaf <[email protected]>

===================================================================

net/ipv4/netfilter/ipt_recent.c +8 -0

@@ -35,14 +35,20 @@
 static unsigned int ip_pkt_list_tot = 20;
 static unsigned int ip_list_hash_size = 0;
 static unsigned int ip_list_perms = 0644;
+static unsigned int ip_list_uid = 0;
+static unsigned int ip_list_gid = 0;
 module_param(ip_list_tot, uint, 0400);
 module_param(ip_pkt_list_tot, uint, 0400);
 module_param(ip_list_hash_size, uint, 0400);
 module_param(ip_list_perms, uint, 0400);
+module_param(ip_list_uid, uint, 0400);
+module_param(ip_list_gid, uint, 0400);
 MODULE_PARM_DESC(ip_list_tot, "number of IPs to remember per list");
 MODULE_PARM_DESC(ip_pkt_list_tot, "number of packets per IP to remember (max. 255)");
 MODULE_PARM_DESC(ip_list_hash_size, "size of hash table used to look up IPs");
 MODULE_PARM_DESC(ip_list_perms, "permissions on /proc/net/ipt_recent/* files");
+MODULE_PARM_DESC(ip_list_uid,"owner of /proc/net/ipt_recent/* files");
+MODULE_PARM_DESC(ip_list_gid,"owning group of /proc/net/ipt_recent/* files");
 
 
 struct recent_entry {

@@ -274,6 +280,8 @@
 		goto out;
 	}
 	t->proc->proc_fops = &recent_fops;
+	t->proc->uid       = ip_list_uid;
+	t->proc->gid       = ip_list_gid;
 	t->proc->data      = t;
 #endif
 	spin_lock_bh(&recent_lock);

Patrick McHardy

Applied

2006-07-09 03:43 UTC #5 lore raw

Quoted 1 line · Daniel De Graaf

Add support for setting the UID and GID of /proc/net/ipt_recent/* files.

Applied, will probably push tomorrow. Thanks Daniel.