d/freebsd-nq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

By default, don't allow processes in a jail to list the set of

Browse Source 
jails in the system.  Previous behavior (allowed) may be restored
by setting security.jail.list_allowed=1.
This commit is contained in:
Robert Watson 2004-02-14 19:19:47 +00:00
parent 7e440242e5
commit 679a106075
1 changed files with 7 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
sys/kern/kern_jail.c
View File

@ -59,6 +59,11 @@ SYSCTL_INT(_security_jail, OID_AUTO, getfsstate_getfsstatroot_only, CTLFLAG_RW,
&jail_getfsstatroot_only, 0,
"Processes see only their root file system in getfsstat()");
int jail_list_allowed = 0;
SYSCTL_INT(_security_jail, OID_AUTO, list_allowed, CTLFLAG_RW,
&jail_list_allowed, 0,
"Processes in jail can access system jail list");
/* allprison, lastprid, and prisoncount are protected by allprison_mtx. */
struct prisonlist allprison;
struct mtx allprison_mtx;
@ -446,6 +451,8 @@ sysctl_jail_list(SYSCTL_HANDLER_ARGS)
int count, error;
mtx_assert(&Giant, MA_OWNED);
if (jailed(req->td->td_ucred) && !jail_list_allowed)
return (0);
retry:
mtx_lock(&allprison_mtx);
count = prisoncount;