d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

If we cannot connect to casperd we don't enter sandbox, but if we can connect

Browse Source 
to casperd, but we cannot access the service we need we exit with an error.
This should not happen and just indicates some configuration error which
should be fixed, so we force the user to do it by failing.

Discussed with:	emaste
This commit is contained in:
Pawel Jakub Dawidek 2013-12-19 00:51:48 +00:00
parent 4106732882
commit 8ff3952b72
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=259580
2 changed files with 16 additions and 38 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
contrib/tcpdump/tcpdump.c
View File

@ -710,24 +710,16 @@ capdns_setup(void)
capdnsloc = cap_service_open(capcas, "system.dns");
/* Casper capability no longer needed. */
cap_close(capcas);
if (capdnsloc == NULL) {
warning("unable to open system.dns service");
return (NULL);
}
if (capdnsloc == NULL)
error("unable to open system.dns service");
/* Limit system.dns to reverse DNS lookups. */
types[0] = "ADDR";
if (cap_dns_type_limit(capdnsloc, types, 1) < 0) {
warning("unable to limit access to system.dns service");
cap_close(capdnsloc);
return (NULL);
}
if (cap_dns_type_limit(capdnsloc, types, 1) < 0)
error("unable to limit access to system.dns service");
families[0] = AF_INET;
families[1] = AF_INET6;
if (cap_dns_family_limit(capdnsloc, families, 2) < 0) {
warning("unable to limit access to system.dns service");
cap_close(capdnsloc);
return (NULL);
}
if (cap_dns_family_limit(capdnsloc, families, 2) < 0)
error("unable to limit access to system.dns service");
return (capdnsloc);
}

34
usr.bin/kdump/kdump.c
View File

@ -215,7 +215,7 @@ cappwdgrp_setup(cap_channel_t **cappwdp, cap_channel_t **capgrpp)
capcas = cap_init();
if (capcas == NULL) {
warn("unable to contact casperd");
return (NULL);
return (-1);
}
cappwdloc = cap_service_open(capcas, "system.pwd");
capgrploc = cap_service_open(capcas, "system.grp");
@ -226,40 +226,26 @@ cappwdgrp_setup(cap_channel_t **cappwdp, cap_channel_t **capgrpp)
warn("unable to open system.pwd service");
if (capgrploc == NULL)
warn("unable to open system.grp service");
goto fail;
exit(1);
}
/* Limit system.pwd to only getpwuid() function and pw_name field. */
cmds[0] = "getpwuid";
if (cap_pwd_limit_cmds(cappwdloc, cmds, 1) < 0) {
warn("unable to limit access to system.pwd service");
goto fail;
}
if (cap_pwd_limit_cmds(cappwdloc, cmds, 1) < 0)
err(1, "unable to limit system.pwd service");
fields[0] = "pw_name";
if (cap_pwd_limit_fields(cappwdloc, fields, 1) < 0) {
warn("unable to limit access to system.pwd service");
goto fail;
}
if (cap_pwd_limit_fields(cappwdloc, fields, 1) < 0)
err(1, "unable to limit system.pwd service");
/* Limit system.grp to only getgrgid() function and gr_name field. */
cmds[0] = "getgrgid";
if (cap_grp_limit_cmds(capgrploc, cmds, 1) < 0) {
warn("unable to limit access to system.grp service");
goto fail;
}
if (cap_grp_limit_cmds(capgrploc, cmds, 1) < 0)
err(1, "unable to limit system.grp service");
fields[0] = "gr_name";
if (cap_grp_limit_fields(capgrploc, fields, 1) < 0) {
warn("unable to limit access to system.grp service");
goto fail;
}
if (cap_grp_limit_fields(capgrploc, fields, 1) < 0)
err(1, "unable to limit system.grp service");
*cappwdp = cappwdloc;
*capgrpp = capgrploc;
return (0);
fail:
if (capgrploc == NULL)
cap_close(cappwdloc);
if (capgrploc == NULL)
cap_close(capgrploc);
return (-1);
}
#endif /* HAVE_LIBCAPSICUM */