Linux-kernel mailing list archive 1999-22,: Re: [PATCH]: alternative security - special gids

# Re: [PATCH]: alternative security - special gids

Augusto Cesar (bishop@sekure.org)
Sun, 30 May 1999 12:41:41 -0300 (EST)

- Messages sorted by: [ date ][ thread ][ subject ][ author ]
- Next message: Siddharth Srivastava: "Re: Lauching a userland program inside the kernel"
- Previous message: Horst von Brand: "Re: [PATCH] Improving send_sigio() scalability"

On Fri, 28 May 1999, Augusto Cesar wrote:

Im sorry, pine have some problems with the permissions of attached patch.
Im sending as plaintext.

------------------

diff -urN v2.2.9/include/linux/sysctl.h linux/include/linux/sysctl.h
--- v2.2.9/include/linux/sysctl.h Sat Apr 24 16:47:47 1999
+++ linux/include/linux/sysctl.h Fri May 28 18:03:46 1999
@@ -223,7 +223,9 @@
NET_IPV4_ICMP_PARAMPROB_RATE=62,
NET_IPV4_ICMP_ECHOREPLY_RATE=63,
NET_IPV4_ICMP_IGNORE_BOGUS_ERROR_RESPONSES=64,
- NET_IPV4_IGMP_MAX_MEMBERSHIPS=65
+ NET_IPV4_IGMP_MAX_MEMBERSHIPS=65,
+ NET_IPV4_SOCKET_PORT_GID=66,
+ NET_IPV4_SOCKET_RAW_GID=67,
};
enum {
diff -urN v2.2.9/net/ipv4/af_inet.c linux/net/ipv4/af_inet.c
--- v2.2.9/net/ipv4/af_inet.c Thu Apr 22 23:45:19 1999
+++ linux/net/ipv4/af_inet.c Fri May 28 18:28:51 1999
@@ -54,6 +54,7 @@
* Some other random speedups.
* Cyrus Durgin : Cleaned up file for kmod hacks.
* Andi Kleen : Fix inet_stream_connect TCP race.
+ * Augusto Cesar : Added special gids support.
*
* This program is free software; you can redistribute it
and/or
* modify it under the terms of the GNU General Public
License
@@ -120,6 +121,10 @@

struct linux_mib net_statistics;

+/* default control parameters for special gids */
+int sysctl_socket_port_gid = 16;
+int sysctl_socket_raw_gid = 17;
+
extern int raw_get_info(char *, char **, off_t, int, int);
extern int snmp_get_info(char *, char **, off_t, int, int);
extern int netstat_get_info(char *, char **, off_t, int, int);
@@ -330,6 +335,7 @@
/* Compatibility */
if (sock->type == SOCK_PACKET) {
static int warned;
+
if (net_families[PF_PACKET]==NULL)
{
#if defined(CONFIG_KMOD) && defined(CONFIG_PACKET_MODULE)
@@ -375,7 +381,8 @@
break;
case SOCK_RAW:
if (!capable(CAP_NET_RAW))
- goto free_and_badperm;
+ if (current->egid != sysctl_socket_raw_gid)
+ goto free_and_badperm;
if (!protocol)
goto free_and_noproto;
prot = &raw_prot;
@@ -543,7 +550,8 @@
if (snum == 0)
snum = sk->prot->good_socknum();
if (snum < PROT_SOCK && !capable(CAP_NET_BIND_SERVICE))
- return(-EACCES);
+ if (current->egid != sysctl_socket_port_gid)
+ return(-EACCES);
/* Make sure we are allowed to bind here. */
if(sk->prot->verify_bind(sk, snum))
diff -urN v2.2.9/net/ipv4/sysctl_net_ipv4.c
linux/net/ipv4/sysctl_net_ipv4.c
--- v2.2.9/net/ipv4/sysctl_net_ipv4.c Mon Jan 4 21:31:35 1999
+++ linux/net/ipv4/sysctl_net_ipv4.c Fri May 28 18:03:22 1999
@@ -28,6 +28,10 @@
static int boolean_max = 1;
#endif
+/* From af_inet.c */
+extern int sysctl_socket_port_gid;
+extern int sysctl_socket_raw_gid;
+
/* From icmp.c */
extern int sysctl_icmp_echo_ignore_all;
extern int sysctl_icmp_echo_ignore_broadcasts;
@@ -95,6 +99,12 @@
ctl_table ipv4_table[] = {
+ {NET_IPV4_SOCKET_PORT_GID, "socket_port_gid",
+ &sysctl_socket_port_gid, sizeof(int), 0644, NULL,
+ &proc_dointvec},
+ {NET_IPV4_SOCKET_RAW_GID, "socket_raw_gid",
+ &sysctl_socket_raw_gid, sizeof(int), 0644, NULL,
+ &proc_dointvec},
{NET_IPV4_TCP_TIMESTAMPS, "tcp_timestamps",
&sysctl_tcp_timestamps, sizeof(int), 0644, NULL,
&proc_dointvec},

--------------------

    --
    Augusto Cesar
    Sekure SDI
    http://www.sekure.org

    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.rutgers.edu
    Please read the FAQ at http://www.tux.org/lkml/

- Next message: Siddharth Srivastava: "Re: Lauching a userland program inside the kernel"
- Previous message: Horst von Brand: "Re: [PATCH] Improving send_sigio() scalability"