|
 |
df4535 |
From 6d1b02218a591ff95053b22c1ed802355e44878d Mon Sep 17 00:00:00 2001
|
|
|
df4535 |
From: Phil Sutter <phil@nwl.cc>
|
|
|
df4535 |
Date: Tue, 18 Jan 2022 22:39:08 +0100
|
|
|
df4535 |
Subject: [PATCH] xshared: Fix response to unprivileged users
|
|
|
df4535 |
|
|
|
df4535 |
Expected behaviour in both variants is:
|
|
|
df4535 |
|
|
|
df4535 |
* Print help without error, append extension help if -m and/or -j
|
|
|
df4535 |
options are present
|
|
|
df4535 |
* Indicate lack of permissions in an error message for anything else
|
|
|
df4535 |
|
|
|
df4535 |
With iptables-nft, this was broken basically from day 1. Shared use of
|
|
|
df4535 |
do_parse() then somewhat broke legacy: it started complaining about
|
|
|
df4535 |
inability to create a lock file.
|
|
|
df4535 |
|
|
|
df4535 |
Fix this by making iptables-nft assume extension revision 0 is present
|
|
|
df4535 |
if permissions don't allow to verify. This is consistent with legacy.
|
|
|
df4535 |
|
|
|
df4535 |
Second part is to exit directly after printing help - this avoids having
|
|
|
df4535 |
to make the following code "nop-aware" to prevent privileged actions.
|
|
|
df4535 |
|
|
|
df4535 |
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
|
|
df4535 |
Reviewed-by: Florian Westphal <fw@strlen.de>
|
|
|
df4535 |
(cherry picked from commit 26ecdf53960658771c0fc582f72a4025e2887f75)
|
|
|
df4535 |
|
|
|
df4535 |
Conflicts:
|
|
|
df4535 |
iptables/xshared.c
|
|
|
df4535 |
-> Some chunks not applied as not necessary in RHEL8.
|
|
|
df4535 |
---
|
|
|
df4535 |
iptables/nft.c | 5 ++
|
|
|
df4535 |
.../testcases/iptables/0008-unprivileged_0 | 60 +++++++++++++++++++
|
|
|
df4535 |
2 files changed, 65 insertions(+)
|
|
|
df4535 |
create mode 100755 iptables/tests/shell/testcases/iptables/0008-unprivileged_0
|
|
|
df4535 |
|
|
|
df4535 |
diff --git a/iptables/nft.c b/iptables/nft.c
|
|
|
df4535 |
index dc5490c085364..c5cc6f83bf573 100644
|
|
|
df4535 |
--- a/iptables/nft.c
|
|
|
df4535 |
+++ b/iptables/nft.c
|
|
|
df4535 |
@@ -3110,6 +3110,11 @@ int nft_compatible_revision(const char *name, uint8_t rev, int opt)
|
|
|
df4535 |
err:
|
|
|
df4535 |
mnl_socket_close(nl);
|
|
|
df4535 |
|
|
|
df4535 |
+ /* pretend revision 0 is valid if not permitted to check -
|
|
|
df4535 |
+ * this is required for printing extension help texts as user */
|
|
|
df4535 |
+ if (ret < 0 && errno == EPERM && rev == 0)
|
|
|
df4535 |
+ return 1;
|
|
|
df4535 |
+
|
|
|
df4535 |
return ret < 0 ? 0 : 1;
|
|
|
df4535 |
}
|
|
|
df4535 |
|
|
|
df4535 |
diff --git a/iptables/tests/shell/testcases/iptables/0008-unprivileged_0 b/iptables/tests/shell/testcases/iptables/0008-unprivileged_0
|
|
|
df4535 |
new file mode 100755
|
|
|
df4535 |
index 0000000000000..43e3bc8721dbd
|
|
|
df4535 |
--- /dev/null
|
|
|
df4535 |
+++ b/iptables/tests/shell/testcases/iptables/0008-unprivileged_0
|
|
|
df4535 |
@@ -0,0 +1,60 @@
|
|
|
df4535 |
+#!/bin/bash
|
|
|
df4535 |
+
|
|
|
df4535 |
+# iptables may print match/target specific help texts
|
|
|
df4535 |
+# help output should work for unprivileged users
|
|
|
df4535 |
+
|
|
|
df4535 |
+run() {
|
|
|
df4535 |
+ echo "running: $*" >&2
|
|
|
df4535 |
+ runuser -u nobody -- "$@"
|
|
|
df4535 |
+}
|
|
|
df4535 |
+
|
|
|
df4535 |
+grep_or_rc() {
|
|
|
df4535 |
+ declare -g rc
|
|
|
df4535 |
+ grep -q "$*" && return 0
|
|
|
df4535 |
+ echo "missing in output: $*" >&2
|
|
|
df4535 |
+ return 1
|
|
|
df4535 |
+}
|
|
|
df4535 |
+
|
|
|
df4535 |
+out=$(run $XT_MULTI iptables --help)
|
|
|
df4535 |
+let "rc+=$?"
|
|
|
df4535 |
+grep_or_rc "iptables -h (print this help information)" <<< "$out"
|
|
|
df4535 |
+let "rc+=$?"
|
|
|
df4535 |
+
|
|
|
df4535 |
+out=$(run $XT_MULTI iptables -m limit --help)
|
|
|
df4535 |
+let "rc+=$?"
|
|
|
df4535 |
+grep_or_rc "limit match options:" <<< "$out"
|
|
|
df4535 |
+let "rc+=$?"
|
|
|
df4535 |
+
|
|
|
df4535 |
+out=$(run $XT_MULTI iptables -p tcp --help)
|
|
|
df4535 |
+let "rc+=$?"
|
|
|
df4535 |
+grep_or_rc "tcp match options:" <<< "$out"
|
|
|
df4535 |
+let "rc+=$?"
|
|
|
df4535 |
+
|
|
|
df4535 |
+out=$(run $XT_MULTI iptables -j DNAT --help)
|
|
|
df4535 |
+let "rc+=$?"
|
|
|
df4535 |
+grep_or_rc "DNAT target options:" <<< "$out"
|
|
|
df4535 |
+let "rc+=$?"
|
|
|
df4535 |
+
|
|
|
df4535 |
+out=$(run $XT_MULTI iptables -p tcp -j DNAT --help)
|
|
|
df4535 |
+let "rc+=$?"
|
|
|
df4535 |
+grep_or_rc "tcp match options:" <<< "$out"
|
|
|
df4535 |
+let "rc+=$?"
|
|
|
df4535 |
+out=$(run $XT_MULTI iptables -p tcp -j DNAT --help)
|
|
|
df4535 |
+let "rc+=$?"
|
|
|
df4535 |
+grep_or_rc "DNAT target options:" <<< "$out"
|
|
|
df4535 |
+let "rc+=$?"
|
|
|
df4535 |
+
|
|
|
df4535 |
+
|
|
|
df4535 |
+run $XT_MULTI iptables -L 2>&1 | \
|
|
|
df4535 |
+ grep_or_rc "Permission denied"
|
|
|
df4535 |
+let "rc+=$?"
|
|
|
df4535 |
+
|
|
|
df4535 |
+run $XT_MULTI iptables -A FORWARD -p tcp --dport 123 2>&1 | \
|
|
|
df4535 |
+ grep_or_rc "Permission denied"
|
|
|
df4535 |
+let "rc+=$?"
|
|
|
df4535 |
+
|
|
|
df4535 |
+run $XT_MULTI iptables -A FORWARD -j DNAT --to-destination 1.2.3.4 2>&1 | \
|
|
|
df4535 |
+ grep_or_rc "Permission denied"
|
|
|
df4535 |
+let "rc+=$?"
|
|
|
df4535 |
+
|
|
|
df4535 |
+exit $rc
|
|
|
df4535 |
--
|
|
|
df4535 |
2.34.1
|
|
|
df4535 |
|