netdev - Re: Allow group ownership of TUN/TAP devices.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 02 Feb 2009 17:44:34 +0300
From:	Michael Tokarev <mjt@....msk.ru>
To:	netdev <netdev@...r.kernel.org>
CC:	Guido Guenther <agx@...xcpu.org>
Subject: Re: Allow group ownership of TUN/TAP devices.

Michael Tokarev wrote:
[]
> 2, and this is the main one: How about supplementary groups?
> 
> Here I have a valid usage case: a group of testers running various
> versions of windows using KVM (kernel virtual machine), 1 at a time,
> to test some software.  kvm is set up to use bridge with a tap device
> (there should be a way to connect to the machine).  Anyone on that group
> has to be able to start/stop the virtual machines.
> 
> My first attempt - pretty obvious when I saw -g option of tunctl - is
> to add group ownership for the tun device and add a supplementary group
> to each user (their primary group should be different).  But that fails,
> since kernel only checks for egid, not any other group ids.
> 
> What's the reasoning to not allow supplementary groups and to only check
> for egid?

Like this.

Signed-off-by: Michael Tokarev <mjt@....msk.ru>

Thanks!

/mjt


View attachment "tun-allow-supplementary-groups.diff" of type "text/x-patch" (445 bytes)