Teach route(8) how to deal with root being in a prison. If prison
root is allowed to create raw sockets, then they will be able to create routing sockets, too. However prison-root is not able to manipulate routing tables. So when route(8) attempts to write to a routing socket and recieves EPERM from the kernel, exit rather than moving on with execution. Approved by: bmilekic (mentor)
This commit is contained in:
parent
912467dc98
commit
9251dd77ca
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=129034
@ -273,6 +273,8 @@ bad: usage(*argv);
|
|||||||
rtm->rtm_type = RTM_DELETE;
|
rtm->rtm_type = RTM_DELETE;
|
||||||
rtm->rtm_seq = seqno;
|
rtm->rtm_seq = seqno;
|
||||||
rlen = write(s, next, rtm->rtm_msglen);
|
rlen = write(s, next, rtm->rtm_msglen);
|
||||||
|
if (rlen < 0 && errno == EPERM)
|
||||||
|
err(1, "write to routing socket");
|
||||||
if (rlen < (int)rtm->rtm_msglen) {
|
if (rlen < (int)rtm->rtm_msglen) {
|
||||||
warn("write to routing socket");
|
warn("write to routing socket");
|
||||||
(void) printf("got only %d for rlen\n", rlen);
|
(void) printf("got only %d for rlen\n", rlen);
|
||||||
@ -1223,6 +1225,8 @@ rtmsg(cmd, flags)
|
|||||||
if (debugonly)
|
if (debugonly)
|
||||||
return (0);
|
return (0);
|
||||||
if ((rlen = write(s, (char *)&m_rtmsg, l)) < 0) {
|
if ((rlen = write(s, (char *)&m_rtmsg, l)) < 0) {
|
||||||
|
if (errno == EPERM)
|
||||||
|
err(1, "writing to routing socket");
|
||||||
warn("writing to routing socket");
|
warn("writing to routing socket");
|
||||||
return (-1);
|
return (-1);
|
||||||
}
|
}
|
||||||
|
Loading…
Reference in New Issue
Block a user