freebsd-skq/sys/kern
Konstantin Belousov 7359fdcf5f Allow some dotdot lookups in capability mode.
If dotdot lookup does not escape from the file descriptor passed as
the lookup root, we can allow the component traversal.  Track the
directories traversed, and check the result of dotdot lookup against
the recorded list of the directory vnodes.

Dotdot lookups are enabled by sysctl vfs.lookup_cap_dotdot, currently
disabled by default until more verification of the approach is done.

Disallow non-local filesystems for dotdot, since remote server might
conspire with the local process to allow it to escape the namespace.
This might be too cautious, provide the knob
vfs.lookup_cap_dotdot_nonlocal to override as well.

Idea by:	rwatson
Discussed with:	emaste, jonathan, rwatson
Reviewed by:	mjg (previous version)
Tested by:	pho (previous version)
Sponsored by:	The FreeBSD Foundation
MFC after:	2 week
Differential revision:	https://reviews.freebsd.org/D8110
2016-11-02 12:43:15 +00:00
..
bus_if.m INTRNG: Rework handling with resources. Partially revert r301453. 2016-08-19 10:52:39 +00:00
capabilities.conf Update capabilities.conf comment 2016-09-08 14:04:04 +00:00
clock_if.m
cpufreq_if.m
device_if.m
genassym.sh
imgact_aout.c
imgact_binmisc.c
imgact_elf32.c
imgact_elf64.c
imgact_elf.c Style. 2016-10-04 15:23:03 +00:00
imgact_gzip.c
imgact_shell.c
inflate.c ANSIfy inflate.c 2016-10-04 17:57:30 +00:00
init_main.c Remove register keyword. 2016-10-20 01:21:10 +00:00
init_sysent.c Regnerate after r305140, getdtablesize in capability mode 2016-08-31 18:37:51 +00:00
kern_acct.c Renumber license clauses in sys/kern to avoid skipping #3 2016-09-15 13:16:20 +00:00
kern_alq.c
kern_clock.c Renumber license clauses in sys/kern to avoid skipping #3 2016-09-15 13:16:20 +00:00
kern_clocksource.c
kern_condvar.c cv: do a lockless check for no waiters in cv_signal and cv_broadcastpri 2016-09-06 17:16:59 +00:00
kern_conf.c
kern_cons.c Renumber license clauses in sys/kern to avoid skipping #3 2016-09-15 13:16:20 +00:00
kern_context.c
kern_cpu.c
kern_cpuset.c
kern_ctf.c
kern_descrip.c Give the user a clue as to which process hit maxfiles. 2016-09-24 22:56:13 +00:00
kern_dtrace.c
kern_dump.c
kern_environment.c
kern_et.c
kern_event.c Another issue reported on http://seclists.org/oss-sec/2016/q3/68 is 2016-07-16 13:24:58 +00:00
kern_exec.c Mark a bunch of mpsafe sysctls as such. 2016-10-19 19:42:01 +00:00
kern_exit.c Renumber license clauses in sys/kern to avoid skipping #3 2016-09-15 13:16:20 +00:00
kern_fail.c
kern_ffclock.c
kern_fork.c Add PROC_TRAPCAP procctl(2) controls and global sysctl kern.trap_enocap. 2016-09-21 08:23:33 +00:00
kern_gzio.c
kern_hhook.c Get closer to a VIMAGE network stack teardown from top to bottom rather 2016-06-21 13:48:49 +00:00
kern_idle.c
kern_intr.c
kern_jail.c Move IPv4-specific jail functions to new file netinet/in_jail.c 2016-08-09 02:16:21 +00:00
kern_khelp.c
kern_kthread.c Re-schedule signals after kthread exits, since apparently there are 2016-08-10 13:47:12 +00:00
kern_ktr.c
kern_ktrace.c Renumber license clauses in sys/kern to avoid skipping #3 2016-09-15 13:16:20 +00:00
kern_linker.c kern_linker: Handle module-loading failures in preloaded .ko files 2016-10-13 02:06:23 +00:00
kern_lock.c
kern_lockf.c Fix LINT building. 2016-09-18 07:37:00 +00:00
kern_lockstat.c
kern_loginclass.c
kern_malloc.c Renumber license clauses in sys/kern to avoid skipping #3 2016-09-15 13:16:20 +00:00
kern_mbuf.c
kern_mib.c Mark a bunch of mpsafe sysctls as such. 2016-10-19 19:42:01 +00:00
kern_module.c
kern_mtxpool.c
kern_mutex.c Make no assertions about mutex state when the scheduler is stopped. 2016-09-26 15:30:30 +00:00
kern_ntptime.c Fix a bug in r302252. 2016-07-27 11:40:06 +00:00
kern_numa.c
kern_osd.c
kern_physio.c
kern_pmc.c
kern_poll.c
kern_priv.c
kern_proc.c Renumber license clauses in sys/kern to avoid skipping #3 2016-09-15 13:16:20 +00:00
kern_procctl.c Add the foundation copyrights to procctl kernel sources. 2016-09-23 12:32:20 +00:00
kern_prot.c Renumber license clauses in sys/kern to avoid skipping #3 2016-09-15 13:16:20 +00:00
kern_racct.c
kern_rangelock.c
kern_rctl.c
kern_resource.c Renumber license clauses in sys/kern to avoid skipping #3 2016-09-15 13:16:20 +00:00
kern_rmlock.c
kern_rwlock.c locks: fix compilation for KDTRACE_HOOKS && !ADAPTIVE_* case 2016-08-02 03:05:59 +00:00
kern_sdt.c
kern_sema.c
kern_sendfile.c Fix regression from r297400, which truncates headers in case of low socket 2016-09-22 20:34:44 +00:00
kern_sharedpage.c
kern_shutdown.c Renumber license clauses in sys/kern to avoid skipping #3 2016-09-15 13:16:20 +00:00
kern_sig.c Renumber license clauses in sys/kern to avoid skipping #3 2016-09-15 13:16:20 +00:00
kern_switch.c
kern_sx.c locks: fix sx compilation on mips after r303643 2016-08-03 09:15:10 +00:00
kern_synch.c Renumber license clauses in sys/kern to avoid skipping #3 2016-09-15 13:16:20 +00:00
kern_syscalls.c
kern_sysctl.c Renumber license clauses in sys/kern to avoid skipping #3 2016-09-15 13:16:20 +00:00
kern_tc.c Implement userspace gettimeofday(2) with HPET timecounter. 2016-08-17 09:52:09 +00:00
kern_thr.c Add a mask of optional ptrace() events. 2016-07-15 15:32:09 +00:00
kern_thread.c Rewrite subr_sleepqueue.c use of callouts to not depend on the 2016-07-28 09:09:55 +00:00
kern_time.c Renumber license clauses in sys/kern to avoid skipping #3 2016-09-15 13:16:20 +00:00
kern_timeout.c Renumber license clauses in sys/kern to avoid skipping #3 2016-09-15 13:16:20 +00:00
kern_umtx.c In both do_rw_wrlock() and do_rw_rdlock() after r304808, do not 2016-08-25 19:15:02 +00:00
kern_uuid.c
kern_xxx.c Renumber license clauses in sys/kern to avoid skipping #3 2016-09-15 13:16:20 +00:00
ksched.c
link_elf_obj.c
link_elf.c
linker_if.m
Make.tags.inc
Makefile Don't create pointless backups of generated files in "make sysent". 2016-07-28 21:29:04 +00:00
makesyscalls.sh makesyscalls.sh: remove trailing space on the "created from" line 2016-10-17 13:52:24 +00:00
md4c.c
md5c.c
msi_if.m
p1003_1b.c
pic_if.m INTRNG: Rework handling with resources. Partially revert r301453. 2016-08-19 10:52:39 +00:00
posix4_mib.c
sched_4bsd.c Renumber license clauses in sys/kern to avoid skipping #3 2016-09-15 13:16:20 +00:00
sched_ule.c
serdev_if.m
stack_protector.c
subr_acl_nfs4.c
subr_acl_posix1e.c
subr_autoconf.c Renumber license clauses in sys/kern to avoid skipping #3 2016-09-15 13:16:20 +00:00
subr_blist.c Renumber license clauses in sys/kern to avoid skipping #3 2016-09-15 13:16:20 +00:00
subr_bufring.c
subr_bus_dma.c
subr_bus.c Fix device delete child function. 2016-10-17 10:20:38 +00:00
subr_busdma_bufalloc.c
subr_capability.c
subr_clock.c Renumber license clauses in sys/kern to avoid skipping #3 2016-09-15 13:16:20 +00:00
subr_counter.c
subr_devmap.c
subr_devstat.c
subr_disk.c
subr_dummy_vdso_tc.c
subr_eventhandler.c
subr_fattime.c
subr_firmware.c
subr_gtaskqueue.c Resolve whitespace diff to NextBSD. 2016-10-19 21:01:24 +00:00
subr_hash.c Renumber license clauses in sys/kern to avoid skipping #3 2016-09-15 13:16:20 +00:00
subr_hints.c
subr_intr.c INTRNG - fix MSI/MSIX release path 2016-10-11 17:00:29 +00:00
subr_kdb.c
subr_kobj.c
subr_lock.c Implement trivial backoff for locking primitives. 2016-08-01 21:48:37 +00:00
subr_log.c Renumber license clauses in sys/kern to avoid skipping #3 2016-09-15 13:16:20 +00:00
subr_mbpool.c
subr_mchain.c Renumber license clauses in sys/kern to avoid skipping #3 2016-09-15 13:16:20 +00:00
subr_module.c
subr_msgbuf.c
subr_param.c Renumber license clauses in sys/kern to avoid skipping #3 2016-09-15 13:16:20 +00:00
subr_pcpu.c Renumber license clauses in sys/kern to avoid skipping #3 2016-09-15 13:16:20 +00:00
subr_pctrie.c
subr_power.c
subr_prf.c Include <stdarg.h> instead of <machine/stdarg.h> when compiled as 2016-10-24 18:03:04 +00:00
subr_prof.c Renumber license clauses in sys/kern to avoid skipping #3 2016-09-15 13:16:20 +00:00
subr_rman.c
subr_rtc.c Make resettodr_lock accessible outside subr_rtc.c. Protect 2016-09-21 10:15:08 +00:00
subr_sbuf.c
subr_scanf.c Renumber license clauses in sys/kern to avoid skipping #3 2016-09-15 13:16:20 +00:00
subr_sfbuf.c
subr_sglist.c
subr_sleepqueue.c Micro-optimize sleepq_signal(). 2016-09-04 00:29:48 +00:00
subr_smp.c Handle broadcast NMIs. 2016-10-24 16:40:27 +00:00
subr_stack.c
subr_syscall.c Add PROC_TRAPCAP procctl(2) controls and global sysctl kern.trap_enocap. 2016-09-21 08:23:33 +00:00
subr_taskqueue.c While draining a timeout task prevent the taskqueue_enqueue_timeout() 2016-09-29 10:38:20 +00:00
subr_terminal.c
subr_trap.c The assertion re-added in r302614 was triggered when stopping signal 2016-07-18 10:53:47 +00:00
subr_turnstile.c ddb(4): Add sleepchains to "show allchains" 2016-10-22 18:02:20 +00:00
subr_uio.c In the fueword64(9) wrapper for architectures which do not implemented 2016-10-23 11:23:17 +00:00
subr_unit.c
subr_vmem.c
subr_witness.c Fix WITNESS hints for pagequeue locks. 2016-10-29 20:01:48 +00:00
sys_capability.c capsicum: perform copyout without the fildesc lock held in sys_cap_ioctls_get 2016-10-21 16:12:23 +00:00
sys_generic.c Renumber license clauses in sys/kern to avoid skipping #3 2016-09-15 13:16:20 +00:00
sys_pipe.c Generate syscall tables and update pipe() implementation after r302094. 2016-06-22 21:18:19 +00:00
sys_procdesc.c Hide the boottime and bootimebin globals, provide the getboottime(9) 2016-07-27 11:08:59 +00:00
sys_process.c Don't set P2_PTRACE_FSTP in a process that invokes ptrace(PT_TRACE_ME). 2016-08-19 17:57:14 +00:00
sys_socket.c Renumber license clauses in sys/kern to avoid skipping #3 2016-09-15 13:16:20 +00:00
syscalls.c Remove the obsolete and unused openbsd_poll system call. (Phase 2) 2016-08-18 10:54:39 +00:00
syscalls.master Remove unusedd and obsolete openbsd_poll system call. (Phase 1) 2016-08-18 10:50:40 +00:00
systrace_args.c Regenerate syscall provider argument strings. 2016-09-22 04:50:03 +00:00
sysv_ipc.c
sysv_msg.c
sysv_sem.c
sysv_shm.c Add shmatt_t. 2016-07-26 17:23:49 +00:00
tty_compat.c Renumber license clauses in sys/kern to avoid skipping #3 2016-09-15 13:16:20 +00:00
tty_info.c Renumber license clauses in sys/kern to avoid skipping #3 2016-09-15 13:16:20 +00:00
tty_inq.c
tty_outq.c
tty_pts.c
tty_tty.c
tty_ttydisc.c
tty.c
uipc_accf.c Use correct size type in do_setopt_accept_filter 2016-10-12 00:56:49 +00:00
uipc_debug.c
uipc_domain.c Renumber license clauses in sys/kern to avoid skipping #3 2016-09-15 13:16:20 +00:00
uipc_mbuf2.c Renumber license clauses in sys/kern to avoid skipping #3 2016-09-15 13:16:20 +00:00
uipc_mbuf.c Renumber license clauses in sys/kern to avoid skipping #3 2016-09-15 13:16:20 +00:00
uipc_mbufhash.c
uipc_mqueue.c
uipc_sem.c
uipc_shm.c Eliminate unneeded vm_page_xbusy() and vm_page_xunbusy() operations when 2016-08-14 22:00:45 +00:00
uipc_sockbuf.c Renumber license clauses in sys/kern to avoid skipping #3 2016-09-15 13:16:20 +00:00
uipc_socket.c Adjust the sopt_val pointer on bigendian systems (e.g. MIPS64EB). 2016-09-22 12:41:53 +00:00
uipc_syscalls.c Rework r306337. 2016-10-21 18:27:30 +00:00
uipc_usrreq.c Renumber license clauses in sys/kern to avoid skipping #3 2016-09-15 13:16:20 +00:00
vfs_acl.c
vfs_aio.c Remove duplicated code. 2016-08-17 10:14:22 +00:00
vfs_bio.c Add BUF_TRACKING and FULL_BUF_TRACKING buffer debugging 2016-10-31 23:09:52 +00:00
vfs_cache.c cache: fix up a corner case in r307650 2016-10-20 19:55:50 +00:00
vfs_cluster.c Add BUF_TRACKING and FULL_BUF_TRACKING buffer debugging 2016-10-31 23:09:52 +00:00
vfs_default.c Renumber license clauses in sys/kern to avoid skipping #3 2016-09-15 13:16:20 +00:00
vfs_export.c Renumber license clauses in sys/kern to avoid skipping #3 2016-09-15 13:16:20 +00:00
vfs_extattr.c
vfs_hash.c
vfs_init.c Renumber license clauses in sys/kern to avoid skipping #3 2016-09-15 13:16:20 +00:00
vfs_lookup.c Allow some dotdot lookups in capability mode. 2016-11-02 12:43:15 +00:00
vfs_mount.c vfs: assert empty tmp free list on unmount 2016-10-08 13:38:05 +00:00
vfs_mountroot.c Limit scope of the optimization in r306608 to dounmount() caller only. 2016-10-07 11:38:28 +00:00
vfs_subr.c vfs: clear the tmp free list flag before taking the free vnode list lock 2016-10-08 13:36:59 +00:00
vfs_syscalls.c Allow some dotdot lookups in capability mode. 2016-11-02 12:43:15 +00:00
vfs_vnops.c Renumber license clauses in sys/kern to avoid skipping #3 2016-09-15 13:16:20 +00:00
vnode_if.src Renumber license clauses in sys/kern to avoid skipping #3 2016-09-15 13:16:20 +00:00