netfilter: xt_qtaguid: report only uid tags to non-privileged processes

In the past, a process could only see its own stats (uid-based summary,
and details).
Now we allow any process to see other UIDs uid-based stats, but still
hide the detailed stats.

Change-Id: I7666961ed244ac1d9359c339b048799e5db9facc
Signed-off-by: JP Abgrall <jpa@google.com>

diff --git a/net/netfilter/xt_qtaguid.c b/net/netfilter/xt_qtaguid.c
index 9fd0ffa6c365a88137dd8da5f80212975ae13457..14b003da1423a0fb76fc46f4cd49bd7b43cff5a4 100644 (file)
--- a/net/netfilter/xt_qtaguid.c
+++ b/net/netfilter/xt_qtaguid.c
@@ -2588,8 +2588,9 @@ static int pp_stats_line(struct proc_print_info *ppi, int cnt_set)
        } else {
                tag_t tag = ppi->ts_entry->tn.tag;
                uid_t stat_uid = get_uid_from_tag(tag);
-
-               if (!can_read_other_uid_stats(stat_uid)) {
+               /* Detailed tags are not available to everybody */
+               if (get_atag_from_tag(tag)
+                   && !can_read_other_uid_stats(stat_uid)) {
                        CT_DEBUG("qtaguid: stats line: "
                                 "%s 0x%llx %u: insufficient priv "
                                 "from pid=%u tgid=%u uid=%u\n",