diff options
| author | JP Abgrall <jpa@google.com> | 2011-07-17 16:07:23 -0700 |
|---|---|---|
| committer | Praneeth Bajjuri <praneeth@ti.com> | 2011-09-20 18:03:20 -0700 |
| commit | 978c6850bad916f2ff7bf6150be5d42d781a4b54 (patch) | |
| tree | bda0692ff6c8877d172ec3c9282e7b68b2abf18d /include | |
| parent | 8723ecbaf8e44b32b041104f2aa8502e5cfa77bf (diff) | |
| download | linux-linaro-978c6850bad916f2ff7bf6150be5d42d781a4b54.tar.gz | |
netfilter: xt_qtaguid: add uid permission checks during ctrl/stats access
* uid handling
- Limit UID impersonation to processes with a gid in AID_NET_BW_ACCT.
This affects socket tagging, and data removal.
- Limit stats lookup to own uid or the process gid is in AID_NET_BW_STATS.
This affects stats lookup.
* allow pacifying the module
Setting passive to Y/y will make the module return immediately on
external stimulus.
No more stats and silent success on ctrl writes.
Mainly used when one suspects this module of misbehaving.
Change-Id: I83990862d52a9b0922aca103a0f61375cddeb7c4
Signed-off-by: JP Abgrall <jpa@google.com>
Diffstat (limited to 'include')
| -rw-r--r-- | include/linux/android_aid.h | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/include/linux/android_aid.h b/include/linux/android_aid.h index 7f16a14c0fe..0f904b3ba7f 100644 --- a/include/linux/android_aid.h +++ b/include/linux/android_aid.h @@ -22,5 +22,7 @@ #define AID_INET 3003 #define AID_NET_RAW 3004 #define AID_NET_ADMIN 3005 +#define AID_NET_BW_STATS 3006 /* read bandwidth statistics */ +#define AID_NET_BW_ACCT 3007 /* change bandwidth statistics accounting */ #endif |