Reviewed by: the cast of thousands
This is the change to struct sockets that gets rid of so_uid and replaces it with a much more useful struct pcred *so_cred. This is here to be able to do socket-level credential checks (i.e. IPFW uid/gid support, to be added to HEAD soon). Along with this comes an update to pidentd which greatly simplifies the code necessary to get a uid from a socket. Soon to come: a sysctl() interface to finding individual sockets' credentials.
This commit is contained in:
parent
eb9ae2c0ce
commit
f29be02190
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=47992
@ -31,7 +31,7 @@
|
||||
* SUCH DAMAGE.
|
||||
*
|
||||
* @(#)uipc_socket2.c 8.1 (Berkeley) 6/10/93
|
||||
* $Id: uipc_socket2.c,v 1.45 1999/05/03 23:57:24 billf Exp $
|
||||
* $Id: uipc_socket2.c,v 1.46 1999/05/10 18:15:40 peter Exp $
|
||||
*/
|
||||
|
||||
#include <sys/param.h>
|
||||
@ -213,7 +213,9 @@ sonewconn(head, connstatus)
|
||||
so->so_state = head->so_state | SS_NOFDREF;
|
||||
so->so_proto = head->so_proto;
|
||||
so->so_timeo = head->so_timeo;
|
||||
so->so_uid = head->so_uid;
|
||||
so->so_cred = head->so_cred;
|
||||
if (so->so_cred)
|
||||
so->so_cred->p_refcnt++;
|
||||
(void) soreserve(so, head->so_snd.sb_hiwat, head->so_rcv.sb_hiwat);
|
||||
|
||||
if ((*so->so_proto->pr_usrreqs->pru_attach)(so, 0, NULL)) {
|
||||
@ -915,7 +917,7 @@ sotoxsocket(struct socket *so, struct xsocket *xso)
|
||||
xso->so_oobmark = so->so_oobmark;
|
||||
sbtoxsockbuf(&so->so_snd, &xso->so_snd);
|
||||
sbtoxsockbuf(&so->so_rcv, &xso->so_rcv);
|
||||
xso->so_uid = so->so_uid;
|
||||
xso->so_uid = so->so_cred ? so->so_cred->pc_ucred->cr_uid : -1;
|
||||
}
|
||||
|
||||
/*
|
||||
|
@ -31,18 +31,19 @@
|
||||
* SUCH DAMAGE.
|
||||
*
|
||||
* @(#)uipc_socket.c 8.3 (Berkeley) 4/15/94
|
||||
* $Id: uipc_socket.c,v 1.58 1999/05/21 15:54:40 ache Exp $
|
||||
* $Id: uipc_socket.c,v 1.59 1999/06/04 02:27:02 peter Exp $
|
||||
*/
|
||||
|
||||
#include <sys/param.h>
|
||||
#include <sys/systm.h>
|
||||
#include <sys/proc.h>
|
||||
#include <sys/fcntl.h>
|
||||
#include <sys/malloc.h>
|
||||
#include <sys/mbuf.h>
|
||||
#include <sys/domain.h>
|
||||
#include <sys/kernel.h>
|
||||
#include <sys/malloc.h>
|
||||
#include <sys/poll.h>
|
||||
#include <sys/proc.h>
|
||||
#include <sys/protosw.h>
|
||||
#include <sys/socket.h>
|
||||
#include <sys/socketvar.h>
|
||||
@ -124,8 +125,10 @@ socreate(dom, aso, type, proto, p)
|
||||
TAILQ_INIT(&so->so_incomp);
|
||||
TAILQ_INIT(&so->so_comp);
|
||||
so->so_type = type;
|
||||
if (p != 0)
|
||||
so->so_uid = p->p_ucred->cr_uid;
|
||||
if (p) {
|
||||
so->so_cred = p->p_cred;
|
||||
so->so_cred->p_refcnt++;
|
||||
} else so->so_cred = NULL;
|
||||
so->so_proto = prp;
|
||||
error = (*prp->pr_usrreqs->pru_attach)(so, proto, p);
|
||||
if (error) {
|
||||
@ -156,6 +159,10 @@ sodealloc(so)
|
||||
struct socket *so;
|
||||
{
|
||||
so->so_gencnt = ++so_gencnt;
|
||||
if (so->so_cred && --so->so_cred->p_refcnt == 0) {
|
||||
crfree(so->so_cred->pc_ucred);
|
||||
FREE(so->so_cred, M_SUBPROC);
|
||||
}
|
||||
zfreei(so->so_zone, so);
|
||||
}
|
||||
|
||||
|
@ -31,7 +31,7 @@
|
||||
* SUCH DAMAGE.
|
||||
*
|
||||
* @(#)uipc_socket2.c 8.1 (Berkeley) 6/10/93
|
||||
* $Id: uipc_socket2.c,v 1.45 1999/05/03 23:57:24 billf Exp $
|
||||
* $Id: uipc_socket2.c,v 1.46 1999/05/10 18:15:40 peter Exp $
|
||||
*/
|
||||
|
||||
#include <sys/param.h>
|
||||
@ -213,7 +213,9 @@ sonewconn(head, connstatus)
|
||||
so->so_state = head->so_state | SS_NOFDREF;
|
||||
so->so_proto = head->so_proto;
|
||||
so->so_timeo = head->so_timeo;
|
||||
so->so_uid = head->so_uid;
|
||||
so->so_cred = head->so_cred;
|
||||
if (so->so_cred)
|
||||
so->so_cred->p_refcnt++;
|
||||
(void) soreserve(so, head->so_snd.sb_hiwat, head->so_rcv.sb_hiwat);
|
||||
|
||||
if ((*so->so_proto->pr_usrreqs->pru_attach)(so, 0, NULL)) {
|
||||
@ -915,7 +917,7 @@ sotoxsocket(struct socket *so, struct xsocket *xso)
|
||||
xso->so_oobmark = so->so_oobmark;
|
||||
sbtoxsockbuf(&so->so_snd, &xso->so_snd);
|
||||
sbtoxsockbuf(&so->so_rcv, &xso->so_rcv);
|
||||
xso->so_uid = so->so_uid;
|
||||
xso->so_uid = so->so_cred ? so->so_cred->pc_ucred->cr_uid : -1;
|
||||
}
|
||||
|
||||
/*
|
||||
|
@ -31,7 +31,7 @@
|
||||
* SUCH DAMAGE.
|
||||
*
|
||||
* @(#)in_pcb.c 8.4 (Berkeley) 5/24/95
|
||||
* $Id: in_pcb.c,v 1.48 1999/04/27 11:17:31 phk Exp $
|
||||
* $Id: in_pcb.c,v 1.49 1999/04/28 11:37:44 phk Exp $
|
||||
*/
|
||||
|
||||
#include <sys/param.h>
|
||||
@ -202,7 +202,7 @@ in_pcbbind(inp, nam, p)
|
||||
return (EACCES);
|
||||
if (p && p->p_prison)
|
||||
prison = 1;
|
||||
if (so->so_uid &&
|
||||
if (so->so_cred &&
|
||||
!IN_MULTICAST(ntohl(sin->sin_addr.s_addr))) {
|
||||
t = in_pcblookup_local(inp->inp_pcbinfo,
|
||||
sin->sin_addr, lport,
|
||||
@ -212,7 +212,9 @@ in_pcbbind(inp, nam, p)
|
||||
ntohl(t->inp_laddr.s_addr) != INADDR_ANY ||
|
||||
(t->inp_socket->so_options &
|
||||
SO_REUSEPORT) == 0) &&
|
||||
(so->so_uid != t->inp_socket->so_uid))
|
||||
(t->inp_socket->so_cred) &&
|
||||
(so->so_cred->p_ruid !=
|
||||
t->inp_socket->so_cred->p_ruid))
|
||||
return (EADDRINUSE);
|
||||
}
|
||||
t = in_pcblookup_local(pcbinfo, sin->sin_addr,
|
||||
|
@ -36,7 +36,7 @@
|
||||
* SUCH DAMAGE.
|
||||
*
|
||||
* @(#)param.h 8.3 (Berkeley) 4/4/95
|
||||
* $Id: param.h,v 1.47 1999/05/11 19:54:57 phk Exp $
|
||||
* $Id: param.h,v 1.48 1999/05/31 11:29:15 phk Exp $
|
||||
*/
|
||||
|
||||
#ifndef _SYS_PARAM_H_
|
||||
@ -46,7 +46,7 @@
|
||||
#define BSD4_3 1
|
||||
#define BSD4_4 1
|
||||
#undef __FreeBSD_version
|
||||
#define __FreeBSD_version 400006 /* Master, propagated to newvers */
|
||||
#define __FreeBSD_version 400007 /* Master, propagated to newvers */
|
||||
|
||||
#ifndef NULL
|
||||
#define NULL 0
|
||||
|
@ -31,7 +31,7 @@
|
||||
* SUCH DAMAGE.
|
||||
*
|
||||
* @(#)socketvar.h 8.3 (Berkeley) 2/19/95
|
||||
* $Id: socketvar.h,v 1.36 1999/02/01 21:16:31 newton Exp $
|
||||
* $Id: socketvar.h,v 1.37 1999/04/04 21:41:28 dt Exp $
|
||||
*/
|
||||
|
||||
#ifndef _SYS_SOCKETVAR_H_
|
||||
@ -105,7 +105,7 @@ struct socket {
|
||||
|
||||
void (*so_upcall) __P((struct socket *, void *, int));
|
||||
void *so_upcallarg;
|
||||
uid_t so_uid; /* who opened the socket */
|
||||
struct pcred *so_cred; /* user credentials */
|
||||
/* NB: generation count must not be first; easiest to make it last. */
|
||||
so_gen_t so_gencnt; /* generation count */
|
||||
void *so_emuldata; /* private data for emulators */
|
||||
|
Loading…
Reference in New Issue
Block a user