d/freebsd-nq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Add new privileges, PRIV_KMEM_READ and PRIV_KMEM_WRITE, used in opening

Browse Source 
/dev/kmem and /dev/mem (in addition to traditional file permission checks).
PRIV_KMEM_READ is different from other PRIV_* checks in that it's allowed
by default.

Reviewed by:	kib, mckusick
This commit is contained in:
Jamie Gritton 2013-07-05 21:31:16 +00:00
parent 12df7d65b0
commit c71e336230
3 changed files with 24 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
sys/dev/mem/memdev.c
View File

@ -37,6 +37,7 @@ __FBSDID("$FreeBSD$");
#include <sys/memrange.h>
#include <sys/module.h>
#include <sys/mutex.h>
#include <sys/priv.h>
#include <sys/proc.h>
#include <sys/signalvar.h>
#include <sys/systm.h>
@ -67,8 +68,14 @@ memopen(struct cdev *dev __unused, int flags, int fmt __unused,
{
int error = 0;
if (flags & FWRITE)
error = securelevel_gt(td->td_ucred, 0);
if (flags & FREAD)
error = priv_check(td, PRIV_KMEM_READ);
if (flags & FWRITE) {
if (error == 0)
error = priv_check(td, PRIV_KMEM_WRITE);
if (error == 0)
error = securelevel_gt(td->td_ucred, 0);
}
return (error);
}

9
sys/kern/kern_priv.c
View File

@ -141,6 +141,15 @@ priv_check_cred(struct ucred *cred, int priv, int flags)
}
}
/*
* Writes to kernel memory are a typical root-only operation,
* but non-root users are expected to be able to read it.
*/
if (priv == PRIV_KMEM_READ) {
error = 0;
goto out;
}
/*
* Now check with MAC, if enabled, to see if a policy module grants
* privilege.

6
sys/sys/priv.h
View File

@ -493,6 +493,12 @@
#define PRIV_RCTL_ADD_RULE 673
#define PRIV_RCTL_REMOVE_RULE 674
/*
* Kernel memory privileges.
*/
#define PRIV_KMEM_READ 680 /* Read from kernel memory. */
#define PRIV_KMEM_WRITE 681 /* Write to kernel memory. */
/*
* Track end of privilege list.
*/