d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

jail_getid(3): validate jid string input

Browse Source 
Currently, if jail_getid(3) is passed in a numeric string, it assumes that
this is a jid string and passes it back converted to an int without checking
that it's a valid/existing jid. This breaks consumers that might use
jail_getid(3) to see if it can trivially grab a jid from a name if that name
happens to be numeric but not actually the name/jid of the jail. Instead of
returning -1 for the jail not existing, it'll return the int version of the
input and the consumer will not fallback to trying other methods.

Pass the numeric input to jail_get(2) as the jid for validation, rather than
the name. This works well- the kernel enforces that jid=name if name is
numeric, so doing the safe thing and checking numeric input as a jid will
still DTRT based on the description of jail_getid.

Reported by:	Wes Maag
Reviewed by:	jamie, Wes Maag
MFC after:	3 days
Differential Revision:	https://reviews.freebsd.org/D20388
This commit is contained in:
Kyle Evans 2019-05-24 01:28:07 +00:00
parent 1b52cd4553
commit a9cefddd40
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=348215
1 changed files with 12 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
lib/libjail/jail_getid.c
View File

@ -53,13 +53,18 @@ jail_getid(const char *name)
struct iovec jiov[4];
jid = strtoul(name, &ep, 10);
if (*name && !*ep)
return jid;
jiov[0].iov_base = __DECONST(char *, "name");
jiov[0].iov_len = sizeof("name");
jiov[1].iov_len = strlen(name) + 1;
jiov[1].iov_base = alloca(jiov[1].iov_len);
strcpy(jiov[1].iov_base, name);
if (*name && !*ep) {
jiov[0].iov_base = __DECONST(char *, "jid");
jiov[0].iov_len = sizeof("jid");
jiov[1].iov_base = &jid;
jiov[1].iov_len = sizeof(jid);
} else {
jiov[0].iov_base = __DECONST(char *, "name");
jiov[0].iov_len = sizeof("name");
jiov[1].iov_len = strlen(name) + 1;
jiov[1].iov_base = alloca(jiov[1].iov_len);
strcpy(jiov[1].iov_base, name);
}
jiov[2].iov_base = __DECONST(char *, "errmsg");
jiov[2].iov_len = sizeof("errmsg");
jiov[3].iov_base = jail_errmsg;