d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Implement PF_IMMUTABLE flag and apply it to "name" and "jid" in

Browse Source 
jail.conf parameters.  This flag disallows redefinition of the parameter.

"name" and/or "jid" are automatically defined in jail.conf by using
the jail names at the front of jail parameter definitions.  However,
one could override them by using a variable with the same name like
$name = "foo".  This confused the parser and could end up with SIGSEGV.

Note that this change also affects a case when all of parameters are
defined in the command line arguments, not in jail.conf.  Specifically,
"jail -c name=j1 name=j2" no longer works.  This should be harmless.

PR:		196574
Reviewed by:	jamie
Differential Revision:	https://reviews.freebsd.org/D3017
This commit is contained in:
hrs 2015-07-08 16:37:48 +00:00
parent 3702cad714
commit 6a6f4266c7
2 changed files with 8 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
usr.sbin/jail/config.c
View File

@ -111,8 +111,8 @@ static const struct ipspec intparams[] = {
#ifdef INET6
[KP_IP6_ADDR] = {"ip6.addr", 0},
#endif
[KP_JID] = {"jid", 0},
[KP_NAME] = {"name", 0},
[KP_JID] = {"jid", PF_IMMUTABLE},
[KP_NAME] = {"name", PF_IMMUTABLE},
[KP_PATH] = {"path", 0},
[KP_PERSIST] = {"persist", 0},
[KP_SECURELEVEL] = {"securelevel", 0},
@ -362,6 +362,11 @@ add_param(struct cfjail *j, const struct cfparam *p, enum intparam ipnum,
break;
if (dp != NULL) {
/* Found it - append or replace. */
if (dp->flags & PF_IMMUTABLE) {
jail_warnx(j, "cannot redefine variable \"%s\".",
dp->name);
return;
}
if (strcmp(dp->name, name)) {
free(dp->name);
dp->name = estrdup(name);

1
usr.sbin/jail/jailp.h
View File

@ -51,6 +51,7 @@
#define PF_INT 0x20 /* Integer parameter */
#define PF_CONV 0x40 /* Parameter duplicated in converted form */
#define PF_REV 0x80 /* Run commands in reverse order on stopping */
#define PF_IMMUTABLE 0x100 /* Immutable parameter */
#define JF_START 0x0001 /* -c */
#define JF_SET 0x0002 /* -m */