Aren/NetBSD
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

If in highly-secure mode, don't ever allow access to IO ports

Browse Source
This commit is contained in:
tls 1997-04-26 20:30:02 +00:00
parent 64b4faf663
commit 3d9b09a843
2 changed files with 10 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
sys/arch/i386/i386/sys_machdep.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: sys_machdep.c,v 1.32 1997/02/28 04:44:08 mycroft Exp $ */
/* $NetBSD: sys_machdep.c,v 1.33 1997/04/26 20:32:15 tls Exp $ */
/*-
* Copyright (c) 1995 Charles M. Hannum. All rights reserved.
@ -346,7 +346,7 @@ i386_iopl(p, args, retval)
struct trapframe *tf = p->p_md.md_regs;
struct i386_iopl_args ua;
if ((error = suser(p->p_ucred, &p->p_acflag)) != 0)
if ((error = suser(p->p_ucred, &p->p_acflag)) != 0 || securelevel > 1)
return error;
if ((error = copyin(args, &ua, sizeof(ua))) != 0)

10
sys/arch/i386/isa/pcvt/pcvt_ext.c
View File

@ -2740,7 +2740,13 @@ usl_vt_ioctl(Dev_t dev, int cmd, caddr_t data, int flag, struct proc *p)
return (error == ERESTART) ? PCVT_ERESTART : error;
case KDENABIO:
/* grant the process IO access; only allowed if euid == 0 */
/*
* grant the process IO access; only allowed if euid == 0
* and securelevel <= 1. XXX -- this is a fairly serious
* hole, but if closed at securelevel 1, would require
* options INSECURE in order to use X at all.
*/
{
#if PCVT_NETBSD > 9 || PCVT_FREEBSD >= 200
@ -2753,7 +2759,7 @@ usl_vt_ioctl(Dev_t dev, int cmd, caddr_t data, int flag, struct proc *p)
struct syscframe *fp = (struct syscframe *)p->p_regs;
#endif
if(suser(p->p_ucred, &p->p_acflag) != 0)
if(suser(p->p_ucred, &p->p_acflag) || securelevel > 1)
return (EPERM);
#if (PCVT_NETBSD <= 100) || defined(COMPAT_10) || defined(COMPAT_11)