netfilter: xt_owner: Add supplementary groups option

The XT_OWNER_SUPPL_GROUPS flag causes GIDs specified with XT_OWNER_GID to be also checked in the supplementary groups of a process. f_cred->group_info cannot be modified during its lifetime and f_cred holds a reference to it so it's safe to use.

Lukasz Pawelczyk committed 7 years ago

Commit ea6cc2f1 parent 508f7442 files · +24 −6Browse files

Showing the changes to include/uapi/linux (1 of 2 files). Show all

Unified · Split

include/uapi/linux/netfilter/xt_owner.h+4−3

@@ -5,9 +5,10 @@ · 4 unmodified lines
5	5	#include <linux/types.h>
6	6
7	7	enum {
8		− XT_OWNER_UID = 1 << 0,
9		− XT_OWNER_GID = 1 << 1,
10		− XT_OWNER_SOCKET = 1 << 2,
	8	+ XT_OWNER_UID = 1 << 0,
	9	+ XT_OWNER_GID = 1 << 1,
	10	+ XT_OWNER_SOCKET = 1 << 2,
	11	+ XT_OWNER_SUPPL_GROUPS = 1 << 3,
11	12	};
12	13
13	14	struct xt_owner_match_info {