Messages in this thread Patch in this message | | | Date | Sun, 30 May 1999 12:41:41 -0300 (EST) | From | Augusto Cesar <> | Subject | Re: [PATCH]: alternative security - special gids |
| |
On Fri, 28 May 1999, Augusto Cesar wrote:
Im sorry, pine have some problems with the permissions of attached patch. Im sending as plaintext.
------------------
diff -urN v2.2.9/include/linux/sysctl.h linux/include/linux/sysctl.h --- v2.2.9/include/linux/sysctl.h Sat Apr 24 16:47:47 1999 +++ linux/include/linux/sysctl.h Fri May 28 18:03:46 1999 @@ -223,7 +223,9 @@ NET_IPV4_ICMP_PARAMPROB_RATE=62, NET_IPV4_ICMP_ECHOREPLY_RATE=63, NET_IPV4_ICMP_IGNORE_BOGUS_ERROR_RESPONSES=64, - NET_IPV4_IGMP_MAX_MEMBERSHIPS=65 + NET_IPV4_IGMP_MAX_MEMBERSHIPS=65, + NET_IPV4_SOCKET_PORT_GID=66, + NET_IPV4_SOCKET_RAW_GID=67, }; enum { diff -urN v2.2.9/net/ipv4/af_inet.c linux/net/ipv4/af_inet.c --- v2.2.9/net/ipv4/af_inet.c Thu Apr 22 23:45:19 1999 +++ linux/net/ipv4/af_inet.c Fri May 28 18:28:51 1999 @@ -54,6 +54,7 @@ * Some other random speedups. * Cyrus Durgin : Cleaned up file for kmod hacks. * Andi Kleen : Fix inet_stream_connect TCP race. + * Augusto Cesar : Added special gids support. * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License @@ -120,6 +121,10 @@
struct linux_mib net_statistics;
+/* default control parameters for special gids */ +int sysctl_socket_port_gid = 16; +int sysctl_socket_raw_gid = 17; + extern int raw_get_info(char *, char **, off_t, int, int); extern int snmp_get_info(char *, char **, off_t, int, int); extern int netstat_get_info(char *, char **, off_t, int, int); @@ -330,6 +335,7 @@ /* Compatibility */ if (sock->type == SOCK_PACKET) { static int warned; + if (net_families[PF_PACKET]==NULL) { #if defined(CONFIG_KMOD) && defined(CONFIG_PACKET_MODULE) @@ -375,7 +381,8 @@ break; case SOCK_RAW: if (!capable(CAP_NET_RAW)) - goto free_and_badperm; + if (current->egid != sysctl_socket_raw_gid) + goto free_and_badperm; if (!protocol) goto free_and_noproto; prot = &raw_prot; @@ -543,7 +550,8 @@ if (snum == 0) snum = sk->prot->good_socknum(); if (snum < PROT_SOCK && !capable(CAP_NET_BIND_SERVICE)) - return(-EACCES); + if (current->egid != sysctl_socket_port_gid) + return(-EACCES); /* Make sure we are allowed to bind here. */ if(sk->prot->verify_bind(sk, snum)) diff -urN v2.2.9/net/ipv4/sysctl_net_ipv4.c linux/net/ipv4/sysctl_net_ipv4.c --- v2.2.9/net/ipv4/sysctl_net_ipv4.c Mon Jan 4 21:31:35 1999 +++ linux/net/ipv4/sysctl_net_ipv4.c Fri May 28 18:03:22 1999 @@ -28,6 +28,10 @@ static int boolean_max = 1; #endif +/* From af_inet.c */ +extern int sysctl_socket_port_gid; +extern int sysctl_socket_raw_gid; + /* From icmp.c */ extern int sysctl_icmp_echo_ignore_all; extern int sysctl_icmp_echo_ignore_broadcasts; @@ -95,6 +99,12 @@ ctl_table ipv4_table[] = { + {NET_IPV4_SOCKET_PORT_GID, "socket_port_gid", + &sysctl_socket_port_gid, sizeof(int), 0644, NULL, + &proc_dointvec}, + {NET_IPV4_SOCKET_RAW_GID, "socket_raw_gid", + &sysctl_socket_raw_gid, sizeof(int), 0644, NULL, + &proc_dointvec}, {NET_IPV4_TCP_TIMESTAMPS, "tcp_timestamps", &sysctl_tcp_timestamps, sizeof(int), 0644, NULL, &proc_dointvec}, --------------------
-- Augusto Cesar Sekure SDI http://www.sekure.org
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/
| |