module_param_named(stats_perms, proc_stats_perms, uint, S_IRUGO | S_IWUSR);
static struct proc_dir_entry *xt_qtaguid_ctrl_file;
-#ifdef CONFIG_ANDROID_PARANOID_NETWORK
+
+/* Everybody can write. But proc_ctrl_write_limited is true by default which
+ * limits what can be controlled. See the can_*() functions.
+ */
static unsigned int proc_ctrl_perms = S_IRUGO | S_IWUGO;
-#else
-static unsigned int proc_ctrl_perms = S_IRUGO | S_IWUSR;
-#endif
module_param_named(ctrl_perms, proc_ctrl_perms, uint, S_IRUGO | S_IWUSR);
-#ifdef CONFIG_ANDROID_PARANOID_NETWORK
-#include <linux/android_aid.h>
-static gid_t proc_stats_readall_gid = AID_NET_BW_STATS;
-static gid_t proc_ctrl_write_gid = AID_NET_BW_ACCT;
-#else
-/* 0 means, don't limit anybody */
-static gid_t proc_stats_readall_gid;
-static gid_t proc_ctrl_write_gid;
-#endif
-module_param_named(stats_readall_gid, proc_stats_readall_gid, uint,
+/* Limited by default, so the gid of the ctrl and stats proc entries
+ * will limit what can be done. See the can_*() functions.
+ */
+static bool proc_stats_readall_limited = true;
+static bool proc_ctrl_write_limited = true;
+
+module_param_named(stats_readall_limited, proc_stats_readall_limited, bool,
S_IRUGO | S_IWUSR);
-module_param_named(ctrl_write_gid, proc_ctrl_write_gid, uint,
+module_param_named(ctrl_write_limited, proc_ctrl_write_limited, bool,
S_IRUGO | S_IWUSR);
/*
static bool can_manipulate_uids(void)
{
/* root pwnd */
- return unlikely(!current_fsuid()) || unlikely(!proc_ctrl_write_gid)
- || in_egroup_p(proc_ctrl_write_gid);
+ return in_egroup_p(xt_qtaguid_ctrl_file->gid)
+ || unlikely(!current_fsuid()) || unlikely(!proc_ctrl_write_limited)
+ || unlikely(current_fsuid() == xt_qtaguid_ctrl_file->uid);
}
static bool can_impersonate_uid(uid_t uid)
static bool can_read_other_uid_stats(uid_t uid)
{
/* root pwnd */
- return unlikely(!current_fsuid()) || uid == current_fsuid()
- || unlikely(!proc_stats_readall_gid)
- || in_egroup_p(proc_stats_readall_gid);
+ return in_egroup_p(xt_qtaguid_stats_file->gid)
+ || unlikely(!current_fsuid()) || uid == current_fsuid()
+ || unlikely(!proc_stats_readall_limited)
+ || unlikely(current_fsuid() == xt_qtaguid_ctrl_file->uid);
}
static inline void dc_add_byte_packets(struct data_counters *counters, int set,
counters->bpc[set][direction][ifs_proto].packets += packets;
}
-static inline uint64_t dc_sum_bytes(struct data_counters *counters,
- int set,
- enum ifs_tx_rx direction)
-{
- return counters->bpc[set][direction][IFS_TCP].bytes
- + counters->bpc[set][direction][IFS_UDP].bytes
- + counters->bpc[set][direction][IFS_PROTO_OTHER].bytes;
-}
-
-static inline uint64_t dc_sum_packets(struct data_counters *counters,
- int set,
- enum ifs_tx_rx direction)
-{
- return counters->bpc[set][direction][IFS_TCP].packets
- + counters->bpc[set][direction][IFS_UDP].packets
- + counters->bpc[set][direction][IFS_PROTO_OTHER].packets;
-}
-
static struct tag_node *tag_node_tree_search(struct rb_root *root, tag_t tag)
{
struct rb_node *node = root->rb_node;
return iface_entry;
}
+/* This is for fmt2 only */
+static int pp_iface_stat_line(bool header, char *outp,
+ int char_count, struct iface_stat *iface_entry)
+{
+ int len;
+ if (header) {
+ len = snprintf(outp, char_count,
+ "ifname "
+ "total_skb_rx_bytes total_skb_rx_packets "
+ "total_skb_tx_bytes total_skb_tx_packets "
+ "rx_tcp_bytes rx_tcp_packets "
+ "rx_udp_bytes rx_udp_packets "
+ "rx_other_bytes rx_other_packets "
+ "tx_tcp_bytes tx_tcp_packets "
+ "tx_udp_bytes tx_udp_packets "
+ "tx_other_bytes tx_other_packets\n"
+ );
+ } else {
+ struct data_counters *cnts;
+ int cnt_set = 0; /* We only use one set for the device */
+ cnts = &iface_entry->totals_via_skb;
+ len = snprintf(
+ outp, char_count,
+ "%s "
+ "%llu %llu %llu %llu %llu %llu %llu %llu "
+ "%llu %llu %llu %llu %llu %llu %llu %llu\n",
+ iface_entry->ifname,
+ dc_sum_bytes(cnts, cnt_set, IFS_RX),
+ dc_sum_packets(cnts, cnt_set, IFS_RX),
+ dc_sum_bytes(cnts, cnt_set, IFS_TX),
+ dc_sum_packets(cnts, cnt_set, IFS_TX),
+ cnts->bpc[cnt_set][IFS_RX][IFS_TCP].bytes,
+ cnts->bpc[cnt_set][IFS_RX][IFS_TCP].packets,
+ cnts->bpc[cnt_set][IFS_RX][IFS_UDP].bytes,
+ cnts->bpc[cnt_set][IFS_RX][IFS_UDP].packets,
+ cnts->bpc[cnt_set][IFS_RX][IFS_PROTO_OTHER].bytes,
+ cnts->bpc[cnt_set][IFS_RX][IFS_PROTO_OTHER].packets,
+ cnts->bpc[cnt_set][IFS_TX][IFS_TCP].bytes,
+ cnts->bpc[cnt_set][IFS_TX][IFS_TCP].packets,
+ cnts->bpc[cnt_set][IFS_TX][IFS_UDP].bytes,
+ cnts->bpc[cnt_set][IFS_TX][IFS_UDP].packets,
+ cnts->bpc[cnt_set][IFS_TX][IFS_PROTO_OTHER].bytes,
+ cnts->bpc[cnt_set][IFS_TX][IFS_PROTO_OTHER].packets);
+ }
+ return len;
+}
+
static int iface_stat_fmt_proc_read(char *page, char **num_items_returned,
off_t items_to_skip, int char_count,
int *eof, void *data)
return 0;
if (fmt == 2 && item_index++ >= items_to_skip) {
- len = snprintf(outp, char_count,
- "ifname "
- "total_skb_rx_bytes total_skb_rx_packets "
- "total_skb_tx_bytes total_skb_tx_packets\n"
- );
+ len = pp_iface_stat_line(true, outp, char_count, NULL);
if (len >= char_count) {
*outp = '\0';
return outp - page;
stats->tx_bytes, stats->tx_packets
);
} else {
- len = snprintf(
- outp, char_count,
- "%s "
- "%llu %llu %llu %llu\n",
- iface_entry->ifname,
- iface_entry->totals_via_skb[IFS_RX].bytes,
- iface_entry->totals_via_skb[IFS_RX].packets,
- iface_entry->totals_via_skb[IFS_TX].bytes,
- iface_entry->totals_via_skb[IFS_TX].packets
- );
+ len = pp_iface_stat_line(false, outp, char_count,
+ iface_entry);
}
if (len >= char_count) {
spin_unlock_bh(&iface_stat_list_lock);
spin_lock_bh(&iface_stat_list_lock);
entry = get_iface_entry(ifname);
if (entry != NULL) {
- bool activate = !ipv4_is_loopback(ipaddr);
IF_DEBUG("qtaguid: iface_stat: create(%s): entry=%p\n",
ifname, entry);
iface_check_stats_reset_and_adjust(net_dev, entry);
- _iface_stat_set_active(entry, net_dev, activate);
+ _iface_stat_set_active(entry, net_dev, true);
IF_DEBUG("qtaguid: %s(%s): "
"tracking now %d on ip=%pI4\n", __func__,
- entry->ifname, activate, &ipaddr);
- goto done_unlock_put;
- } else if (ipv4_is_loopback(ipaddr)) {
- IF_DEBUG("qtaguid: iface_stat: create(%s): "
- "ignore loopback dev. ip=%pI4\n", ifname, &ipaddr);
+ entry->ifname, true, &ipaddr);
goto done_unlock_put;
}
spin_lock_bh(&iface_stat_list_lock);
entry = get_iface_entry(ifname);
if (entry != NULL) {
- bool activate = !(addr_type & IPV6_ADDR_LOOPBACK);
IF_DEBUG("qtaguid: %s(%s): entry=%p\n", __func__,
ifname, entry);
iface_check_stats_reset_and_adjust(net_dev, entry);
- _iface_stat_set_active(entry, net_dev, activate);
+ _iface_stat_set_active(entry, net_dev, true);
IF_DEBUG("qtaguid: %s(%s): "
"tracking now %d on ip=%pI6c\n", __func__,
- entry->ifname, activate, &ifa->addr);
- goto done_unlock_put;
- } else if (addr_type & IPV6_ADDR_LOOPBACK) {
- IF_DEBUG("qtaguid: %s(%s): "
- "ignore loopback dev. ip=%pI6c\n", __func__,
- ifname, &ifa->addr);
+ entry->ifname, true, &ifa->addr);
goto done_unlock_put;
}
const struct net_device *el_dev;
enum ifs_tx_rx direction = par->in ? IFS_RX : IFS_TX;
int bytes = skb->len;
+ int proto;
if (!skb->dev) {
MT_DEBUG("qtaguid[%d]: no skb->dev\n", par->hooknum);
par->hooknum, __func__);
BUG();
} else {
- int proto = ipx_proto(skb, par);
+ proto = ipx_proto(skb, par);
MT_DEBUG("qtaguid[%d]: dev name=%s type=%d fam=%d proto=%d\n",
par->hooknum, el_dev->name, el_dev->type,
par->family, proto);
IF_DEBUG("qtaguid: %s(%s): entry=%p\n", __func__,
el_dev->name, entry);
- entry->totals_via_skb[direction].bytes += bytes;
- entry->totals_via_skb[direction].packets++;
+ data_counters_update(&entry->totals_via_skb, 0, direction, proto,
+ bytes);
spin_unlock_bh(&iface_stat_list_lock);
}
* - No {0, uid_tag} stats and no {acc_tag, uid_tag} stats.
*/
new_tag_stat = create_if_tag_stat(iface_entry, uid_tag);
+ if (!new_tag_stat)
+ goto unlock;
uid_tag_counters = &new_tag_stat->counters;
} else {
uid_tag_counters = &tag_stat_entry->counters;
if (acct_tag) {
/* Create the child {acct_tag, uid_tag} and hook up parent. */
new_tag_stat = create_if_tag_stat(iface_entry, tag);
+ if (!new_tag_stat)
+ goto unlock;
new_tag_stat->parent_counters = uid_tag_counters;
} else {
/*
BUG_ON(!new_tag_stat);
}
tag_stat_update(new_tag_stat, direction, proto, bytes);
+unlock:
spin_unlock_bh(&iface_entry->tag_stat_list_lock);
}
}
CT_DEBUG("qtaguid: ctrl_tag(%s): "
"pid=%u tgid=%u uid=%u euid=%u fsuid=%u "
- "in_group=%d in_egroup=%d\n",
+ "ctrl.gid=%u in_group()=%d in_egroup()=%d\n",
input, current->pid, current->tgid, current_uid(),
current_euid(), current_fsuid(),
- in_group_p(proc_ctrl_write_gid),
- in_egroup_p(proc_ctrl_write_gid));
+ xt_qtaguid_ctrl_file->gid,
+ in_group_p(xt_qtaguid_ctrl_file->gid),
+ in_egroup_p(xt_qtaguid_ctrl_file->gid));
if (argc < 4) {
uid = current_fsuid();
} else if (!can_impersonate_uid(uid)) {
} else {
tag_t tag = ppi->ts_entry->tn.tag;
uid_t stat_uid = get_uid_from_tag(tag);
-
- if (!can_read_other_uid_stats(stat_uid)) {
+ /* Detailed tags are not available to everybody */
+ if (get_atag_from_tag(tag)
+ && !can_read_other_uid_stats(stat_uid)) {
CT_DEBUG("qtaguid: stats line: "
"%s 0x%llx %u: insufficient priv "
- "from pid=%u tgid=%u uid=%u\n",
+ "from pid=%u tgid=%u uid=%u stats.gid=%u\n",
ppi->iface_entry->ifname,
get_atag_from_tag(tag), stat_uid,
- current->pid, current->tgid, current_fsuid());
+ current->pid, current->tgid, current_fsuid(),
+ xt_qtaguid_stats_file->gid);
return 0;
}
if (ppi->item_index++ < ppi->items_to_skip)
utd_entry = get_uid_data(current_fsuid(), &utd_entry_found);
if (IS_ERR_OR_NULL(utd_entry)) {
res = PTR_ERR(utd_entry);
- goto err;
+ goto err_unlock;
}
/* Look for existing PID based proc_data */
rb_erase(&utd_entry->node, &uid_tag_data_tree);
kfree(utd_entry);
}
+err_unlock:
spin_unlock_bh(&uid_tag_data_tree_lock);
-err:
return res;
}
projects / firefly-linux-kernel-4.4.55.git / blobdiff