d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

- Enforce CAP_MKFIFO on mkfifoat(2), not on mknodat(2). Without this change

Browse Source 
mkfifoat(2) was not restricted.
- Introduce CAP_MKNOD and enforce it on mknodat(2).

Sponsored by:	FreeBSD Foundation
MFC after:	2 weeks
This commit is contained in:
Pawel Jakub Dawidek 2012-10-01 05:43:24 +00:00
parent 0324d54acb
commit 55711729f3
2 changed files with 6 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
sys/kern/vfs_syscalls.c
View File

@ -1334,7 +1334,7 @@ restart:
bwillwrite();
NDINIT_ATRIGHTS(&nd, CREATE,
LOCKPARENT | SAVENAME | MPSAFE | AUDITVNODE1, pathseg, path, fd,
CAP_MKFIFO, td);
CAP_MKNOD, td);
if ((error = namei(&nd)) != 0)
return (error);
vfslocked = NDHASGIANT(&nd);
@ -1458,8 +1458,9 @@ kern_mkfifoat(struct thread *td, int fd, char *path, enum uio_seg pathseg,
AUDIT_ARG_MODE(mode);
restart:
bwillwrite();
NDINIT_AT(&nd, CREATE, LOCKPARENT | SAVENAME | MPSAFE | AUDITVNODE1,
pathseg, path, fd, td);
NDINIT_ATRIGHTS(&nd, CREATE,
LOCKPARENT | SAVENAME | MPSAFE | AUDITVNODE1, pathseg, path, fd,
CAP_MKFIFO, td);
if ((error = namei(&nd)) != 0)
return (error);
vfslocked = NDHASGIANT(&nd);

3
sys/sys/capability.h
View File

@ -81,6 +81,7 @@
#define CAP_MKDIR 0x0000000000200000ULL
#define CAP_RMDIR 0x0000000000400000ULL
#define CAP_MKFIFO 0x0000000000800000ULL
#define CAP_MKNOD 0x0080000000000000ULL
/* Lookups - used to constrain *at() calls. */
#define CAP_LOOKUP 0x0000000001000000ULL
@ -137,7 +138,7 @@
#define CAP_PDKILL 0x0040000000000000ULL
/* The mask of all valid method rights. */
#define CAP_MASK_VALID 0x007fffffffffffffULL
#define CAP_MASK_VALID 0x00ffffffffffffffULL
#ifdef _KERNEL