From 8890f5d020567d7c82cdf9051bafd0610cc75ffe Mon Sep 17 00:00:00 2001 From: Pawel Jakub Dawidek Date: Tue, 27 Nov 2012 10:22:40 +0000 Subject: [PATCH] Allow to use kill(2) in capability mode, but process can send a signal only to himself. For example abort(3) at first tries to do kill(getpid(), SIGABRT) which was failing in capability mode, so the code was failing back to exit(1). Reviewed by: rwatson Obtained from: WHEEL Systems MFC after: 2 weeks --- sys/kern/capabilities.conf | 5 +++++ sys/kern/kern_sig.c | 8 ++++++++ 2 files changed, 13 insertions(+) diff --git a/sys/kern/capabilities.conf b/sys/kern/capabilities.conf index 82eeb07ebe23..11aad16526a1 100644 --- a/sys/kern/capabilities.conf +++ b/sys/kern/capabilities.conf @@ -336,6 +336,11 @@ issetugid ## kevent +## +## Allow kill(2), as we allow the process to send signals only to himself. +## +kill + ## ## Allow message queue operations on file descriptors, subject to capability ## rights. diff --git a/sys/kern/kern_sig.c b/sys/kern/kern_sig.c index 56597ea871e6..a0b5809f1c2a 100644 --- a/sys/kern/kern_sig.c +++ b/sys/kern/kern_sig.c @@ -1679,6 +1679,14 @@ sys_kill(struct thread *td, struct kill_args *uap) struct proc *p; int error; + /* + * A process in capability mode can send signals only to himself. + * The main rationale behind this is that abort(3) is implemented as + * kill(getpid(), SIGABRT). + */ + if (IN_CAPABILITY_MODE(td) && uap->pid != td->td_proc->p_pid) + return (ECAPMODE); + AUDIT_ARG_SIGNUM(uap->signum); AUDIT_ARG_PID(uap->pid); if ((u_int)uap->signum > _SIG_MAXSIG)