bde
f864467045
Fix security holes in sigreturn(), ptrace() and procfs. sigreturn()
attempted to check for insecure and fatal eflags and segment selectors, but missed many cases and got the IOPL check back to front. The other syscalls didn't check at all. sys_process.c, machdep.c: Only allow PT_WRITE_U to write to the registers (ordinary and FP). psl.h, locore.s, machdep.c: Eliminate PSL_MBZ, PSL_MBO and PSL_USERCLR. We are not supposed to assume anything about the reserved bits. Use PSL_USERCHANGE and PSL_KERNEL instead. Rename PSL_USERSET to PSL_USER. exception.s: Define a private label for use by doreti when returning to user mode fails. machdep.c: In syscalls, allow changing only the eflags that can be changed on 486's in user mode (no longer attempt to allow benign IOPL changes; allow changing the nasty PSL_NT; don't allow changing the i586 bits). Don't attempt to check all the cases involving invalid selectors and %eip's. Just check for privilege violations and let the invalid things cause a trap. procfs_machdep.c: Call the ptrace register functions to do all the work for reading and writing ordinary registers and for single stepping. trap.c: Ignore traps caused by PSL_NT being set. Previously, users could cause a fatal trap in user mode by setting PSL_NT and executing an iret, and a fatal trap in kernel mode by setting PSL_NT and making a syscall. PSL_NT was cleared too late and not in enough modes to fix the problem. Make all traps in user mode (except T_NMI) nonfatal. Recover from traps caused by attempting to load invalid user registers in doreti by restarting the traps so that they appear to occur in user mode. --- Fix bogons that I noticed while fixing the above: psl.h: Fix some comments. Uniformize idempotency ifdef. exception.s, machdep.c: Remove rsvd[0-14]. rsvd0 hasn't been reserved since the 486 came out. Replace rsvd0 by `align'. rsvd[0-11] used wrong (magic non-unique) trap numbers. Replace rsvd[1-14] by rsvd. locore.s: Enable alignment check flag on 486's and 586's. machdep.c: Use a better type for kstack[]. Use TFREGP() to find the registers. Reformat ptrace functions from SEF to something closer to KNF. procfs_machdep.c: The wrong pointer to the registers got fixed as a side effect. Implement reading and writing of FP registers. /proc/*/*regs now work (only) for processes that are in memory. Clean up comments. trap.c, trap.h: Remove unused trap types.
----------------------------------------- FreeBSD 2.0 --- ALPHA Release , , ----------------------------------------- /( )` \ \___ / | Welcome to the ALPHA release of FreeBSD 2.0 - the /- _ `-/ ' first public snapshot of our new 4.4BSD Lite based (/\/ \ \ /\ operating system environment. This install proce- / / | ` \ dure is also at the ALPHA stage, and contains only O O ) / | the minimum functionality required by an `-^--'`< ' *EXPERIENCED* person to install the system. (_.) _ ) / It is our hope, of course, that the feedback `.___/` / provided from this snapshot will `-----' / greatly assist us in making the release <----. __ / __ \ of 2.0 much more user friendly. Your <----|====O)))==) \) /==== comments and criticisms are very <----' `--' `.__,' \ valuable to us, so please don't hesitate | | in contacting us! Full details on where and \ / /\ how to provide feedback are given below. ______( (_ / \______/ ,' ,-----' | This install procedure is ALPHA code, and `--{__________) may very possibly *DESTROY* the contents of your ENTIRE DISK! Please do not proceed with this installation unless you've adequately backed up your data first! If any errors occur during this installation, you can see them by toggling over to the alternate screen - type ALT-F2 to switch over, ALT-F1 to switch back to the install screen. The debugging output on the second screen may be very valuable to us in understanding your bug report, so please be sure to take note of it when reporting any failures in the installation! Thanks! Menus and scrolling output windows may be traversed with the arrow and Page Up/Page Down keys. To suspend the installation at any point, hit ESC twice. Hitting TAB will move the focus to different controls. If you've ever dealt with a DOS installation, you'll know how to deal with this. For a more complete description of what's new in this release, please see the release notes. For more documentation on this system, it is recommended that you purchase the 4.4BSD Document Set from O'Reilly Associates and the USENIX Association. ISBN 1-56592-082-1 We have no connection with O'Reilly, we're just satisfied customers! Have fun, and please let us know of any problems you encounter with this release! Comments should be sent to: hackers@FreeBSD.org Bug reports should be sent using the `send-pr' utility, if you were able to get the system installed, otherwise to: bugs@FreeBSD.org And general questions to: questions@FreeBSD.org Please have patience if your questions are not answered right away - this is an especially busy time for us, and our volunteer resources are often strained to the limit (if not somewhat past!). Thanks! The FreeBSD Project
Description
Languages
C
63.3%
C++
23.3%
Roff
5.1%
Shell
2.9%
Makefile
1.5%
Other
3.4%