Aren/NetBSD
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Put procfs policy back in the subsystem.

Browse Source
This commit is contained in:
elad 2009-10-02 23:00:02 +00:00
parent 09f3ac9e2f
commit 51f0d6a0eb
2 changed files with 52 additions and 31 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

50
sys/miscfs/procfs/procfs_vfsops.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: procfs_vfsops.c,v 1.83 2009/03/15 17:22:38 cegger Exp $ */
/* $NetBSD: procfs_vfsops.c,v 1.84 2009/10/02 23:00:02 elad Exp $ */
/*
* Copyright (c) 1993
@ -76,7 +76,7 @@
*/
#include <sys/cdefs.h>
__KERNEL_RCSID(0, "$NetBSD: procfs_vfsops.c,v 1.83 2009/03/15 17:22:38 cegger Exp $");
__KERNEL_RCSID(0, "$NetBSD: procfs_vfsops.c,v 1.84 2009/10/02 23:00:02 elad Exp $");
#if defined(_KERNEL_OPT)
#include "opt_compat_netbsd.h"
@ -110,6 +110,8 @@ VFS_PROTOS(procfs);
static struct sysctllog *procfs_sysctl_log;
static kauth_listener_t procfs_listener;
/*
* VFS Operations.
*
@ -304,6 +306,45 @@ struct vfsops procfs_vfsops = {
{ NULL, NULL },
};
static int
procfs_listener_cb(kauth_cred_t cred, kauth_action_t action, void *cookie,
void *arg0, void *arg1, void *arg2, void *arg3)
{
struct proc *p;
struct pfsnode *pfs;
enum kauth_process_req req;
int result;
result = KAUTH_RESULT_DEFER;
p = arg0;
pfs = arg1;
req = (enum kauth_process_req)(unsigned long)arg2;
if (action != KAUTH_PROCESS_PROCFS)
return result;
/* Privileged; let secmodel handle that. */
if (req == KAUTH_REQ_PROCESS_PROCFS_CTL)
return result;
switch (pfs->pfs_type) {
case PFSregs:
case PFSfpregs:
case PFSmem:
if (kauth_cred_getuid(cred) != kauth_cred_getuid(p->p_cred) ||
ISSET(p->p_flag, PK_SUGID))
break;
/*FALLTHROUGH*/
default:
result = KAUTH_RESULT_ALLOW;
break;
}
return result;
}
static int
procfs_modcmd(modcmd_t cmd, void *arg)
{
@ -330,12 +371,17 @@ procfs_modcmd(modcmd_t cmd, void *arg)
* one more instance of the "number to vfs" mapping problem,
* but "12" is the order as taken from sys/mount.h
*/
procfs_listener = kauth_listen_scope(KAUTH_SCOPE_PROCESS,
procfs_listener_cb, NULL);
break;
case MODULE_CMD_FINI:
error = vfs_detach(&procfs_vfsops);
if (error != 0)
break;
sysctl_teardown(&procfs_sysctl_log);
kauth_unlisten_scope(procfs_listener);
break;
default:
error = ENOTTY;

33
sys/secmodel/suser/secmodel_suser.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: secmodel_suser.c,v 1.7 2009/10/02 22:46:18 elad Exp $ */
/* $NetBSD: secmodel_suser.c,v 1.8 2009/10/02 23:00:02 elad Exp $ */
/*-
* Copyright (c) 2006 Elad Efrat <elad@NetBSD.org>
* All rights reserved.
@ -38,7 +38,7 @@
*/
#include <sys/cdefs.h>
__KERNEL_RCSID(0, "$NetBSD: secmodel_suser.c,v 1.7 2009/10/02 22:46:18 elad Exp $");
__KERNEL_RCSID(0, "$NetBSD: secmodel_suser.c,v 1.8 2009/10/02 23:00:02 elad Exp $");
#include <sys/types.h>
#include <sys/param.h>
@ -574,36 +574,11 @@ secmodel_suser_process_cb(kauth_cred_t cred, kauth_action_t action,
break;
case KAUTH_PROCESS_PROCFS: {
enum kauth_process_req req = (enum kauth_process_req)arg2;
struct pfsnode *pfs = arg1;
if (isroot) {
case KAUTH_PROCESS_PROCFS:
if (isroot)
result = KAUTH_RESULT_ALLOW;
break;
}
if (req == KAUTH_REQ_PROCESS_PROCFS_CTL) {
break;
}
switch (pfs->pfs_type) {
case PFSregs:
case PFSfpregs:
case PFSmem:
if (kauth_cred_getuid(cred) !=
kauth_cred_getuid(p->p_cred) ||
ISSET(p->p_flag, PK_SUGID)) {
break;
}
/*FALLTHROUGH*/
default:
result = KAUTH_RESULT_ALLOW;
break;
}
break;
}
case KAUTH_PROCESS_PTRACE:
if (isroot)