d/freebsd-nq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Dike out a highly insecure UCONSOLE option.

Browse Source 
TIOCCONS must be able to VOP_ACCESS() /dev/console to succeed.

Obtained from:	OpenBSD
This commit is contained in:
Ruslan Ermilov 2002-04-03 10:56:59 +00:00
parent 5cb87b0c59
commit 12c79eb288
14 changed files with 14 additions and 23 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
sys/alpha/conf/GENERIC
View File

@ -63,7 +63,6 @@ options PROCFS #Process filesystem (requires PSEUDOFS)
options PSEUDOFS #Pseudo-filesystem framework
options COMPAT_43 #Compatible with BSD 4.3 [KEEP THIS!]
options SCSI_DELAY=15000 #Delay (in ms) before probing SCSI
options UCONSOLE #Allow users to grab the console
options KTRACE #ktrace(1) syscall trace support
options SYSVSHM #SYSV-style shared memory
options SYSVMSG #SYSV-style message queues

1
sys/alpha/conf/NOTES
View File

@ -63,7 +63,6 @@ options PROCFS #Process filesystem (requires PSEUDOFS)
options PSEUDOFS #Pseudo-filesystem framework
options COMPAT_43 #Compatible with BSD 4.3 [KEEP THIS!]
options SCSI_DELAY=15000 #Delay (in ms) before probing SCSI
options UCONSOLE #Allow users to grab the console
options KTRACE #ktrace(1) syscall trace support
options SYSVSHM #SYSV-style shared memory
options SYSVMSG #SYSV-style message queues

1
sys/alpha/conf/SIMOS
View File

@ -31,7 +31,6 @@ options PROCFS #Process filesystem (requires PSEUDOFS)
options PSEUDOFS #Pseudo-filesystem framework
options "COMPAT_43" #Compatible with BSD 4.3 [KEEP THIS!]
options SCSI_DELAY=100 #Be pessimistic about Joe SCSI device
options UCONSOLE #Allow users to grab the console
config kernel

1
sys/amd64/conf/GENERIC
View File

@ -44,7 +44,6 @@ options PROCFS #Process filesystem (requires PSEUDOFS)
options PSEUDOFS #Pseudo-filesystem framework
options COMPAT_43 #Compatible with BSD 4.3 [KEEP THIS!]
options SCSI_DELAY=15000 #Delay (in ms) before probing SCSI
options UCONSOLE #Allow users to grab the console
#options USERCONFIG #boot -c editor
#options VISUAL_USERCONFIG #visual boot -c editor
options KTRACE #ktrace(1) support

4
sys/conf/NOTES
View File

@ -427,10 +427,6 @@ options PERFMON
options COMPILING_LINT
# XXX - this doesn't belong here.
# Allow ordinary users to take the console - this is useful for X.
options UCONSOLE
# XXX - this doesn't belong here either
#options USERCONFIG #boot -c editor
#options INTRO_USERCONFIG #imply -c and show intro screen

1
sys/conf/options
View File

@ -97,7 +97,6 @@ MSGMNI opt_sysvipc.h
MSGSEG opt_sysvipc.h
MSGSSZ opt_sysvipc.h
MSGTQL opt_sysvipc.h
UCONSOLE
VFS_AIO
# POSIX kernel options

1
sys/i386/conf/GENERIC
View File

@ -44,7 +44,6 @@ options PROCFS #Process filesystem (requires PSEUDOFS)
options PSEUDOFS #Pseudo-filesystem framework
options COMPAT_43 #Compatible with BSD 4.3 [KEEP THIS!]
options SCSI_DELAY=15000 #Delay (in ms) before probing SCSI
options UCONSOLE #Allow users to grab the console
#options USERCONFIG #boot -c editor
#options VISUAL_USERCONFIG #visual boot -c editor
options KTRACE #ktrace(1) support

1
sys/i386/conf/NEWCARD
View File

@ -48,7 +48,6 @@ options PROCFS #Process filesystem (requires PSEUDOFS)
options PSEUDOFS #Pseudo-filesystem framework
options COMPAT_43 #Compatible with BSD 4.3 [KEEP THIS!]
options SCSI_DELAY=15000 #Delay (in ms) before probing SCSI
options UCONSOLE #Allow users to grab the console
#options USERCONFIG #boot -c editor
#options VISUAL_USERCONFIG #visual boot -c editor
options KTRACE #ktrace(1) support

4
sys/i386/conf/NOTES
View File

@ -427,10 +427,6 @@ options PERFMON
options COMPILING_LINT
# XXX - this doesn't belong here.
# Allow ordinary users to take the console - this is useful for X.
options UCONSOLE
# XXX - this doesn't belong here either
#options USERCONFIG #boot -c editor
#options INTRO_USERCONFIG #imply -c and show intro screen

1
sys/ia64/conf/GENERIC
View File

@ -48,7 +48,6 @@ options PROCFS #Process filesystem (requires PSEUDOFS)
options PSEUDOFS #Pseudo-filesystem framework
options COMPAT_43 #Compatible with BSD 4.3 [KEEP THIS!]
options SCSI_DELAY=15000 #Delay (in ms) before probing SCSI
options UCONSOLE #Allow users to grab the console
options KTRACE #ktrace(1) syscall trace support
options SYSVSHM #SYSV-style shared memory
options SYSVMSG #SYSV-style message queues

1
sys/ia64/conf/SKI
View File

@ -47,7 +47,6 @@ options PROCFS #Process filesystem (requires PSEUDOFS)
options PSEUDOFS #Pseudo-filesystem framework
options COMPAT_43 #Compatible with BSD 4.3 [KEEP THIS!]
options SCSI_DELAY=2000 #Delay (in ms) before probing SCSI
options UCONSOLE #Allow users to grab the console
options KTRACE #ktrace(1) syscall trace support
options SYSVSHM #SYSV-style shared memory
options SYSVMSG #SYSV-style message queues

18
sys/kern/tty.c
View File

@ -68,13 +68,13 @@
*/
#include "opt_compat.h"
#include "opt_uconsole.h"
#include <sys/param.h>
#include <sys/systm.h>
#include <sys/filio.h>
#include <sys/lock.h>
#include <sys/mutex.h>
#include <sys/namei.h>
#include <sys/sx.h>
#if defined(COMPAT_43) || defined(COMPAT_SUNOS)
#include <sys/ioctl_compat.h>
@ -849,13 +849,23 @@ ttioctl(tp, cmd, data, flag)
}
case TIOCCONS: /* become virtual console */
if (*(int *)data) {
struct nameidata nid;
if (constty && constty != tp &&
ISSET(constty->t_state, TS_CONNECTED))
return (EBUSY);
#ifndef UCONSOLE
if ((error = suser(td)) != 0)
/* Ensure user can open the real console. */
NDINIT(&nid, LOOKUP, LOCKLEAF | FOLLOW, UIO_SYSSPACE,
"/dev/console", td);
if ((error = namei(&nid)) != 0)
return (error);
#endif
NDFREE(&nid, NDF_ONLY_PNBUF);
error = VOP_ACCESS(nid.ni_vp, VREAD, td->td_ucred, td);
vput(nid.ni_vp);
if (error)
return (error);
constty = tp;
} else if (tp == constty)
constty = NULL;

1
sys/pc98/conf/GENERIC
View File

@ -49,7 +49,6 @@ options COMPAT_43 #Compatible with BSD 4.3 [KEEP THIS!]
options SCSI_DELAY=15000 #Delay (in ms) before probing SCSI
options EPSON_BOUNCEDMA #use bounce buufer for 15-16M
#options EPSON_MEMWIN #EPSON memory window support
options UCONSOLE #Allow users to grab the console
#options LINE30
#options USERCONFIG #boot -c editor
#options VISUAL_USERCONFIG #visual boot -c editor

1
sys/sparc64/conf/GENERIC
View File

@ -49,7 +49,6 @@ options PROCFS #Process filesystem (requires PSEUDOFS)
options PSEUDOFS #Pseudo-filesystem framework
options COMPAT_43 #Compatible with BSD 4.3 [KEEP THIS!]
#options SCSI_DELAY=15000 #Delay (in ms) before probing SCSI
#options UCONSOLE #Allow users to grab the console
options KTRACE #ktrace(1) syscall trace support
options SYSVSHM #SYSV-style shared memory
options SYSVMSG #SYSV-style message queues