Aren/NetBSD
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Put procfs policy back in the subsystem.

Browse Source
This commit is contained in:
elad 2009-10-02 23:00:02 +00:00
parent 09f3ac9e2f
commit 51f0d6a0eb
2 changed files with 52 additions and 31 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

50
sys/miscfs/procfs/procfs_vfsops.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: procfs_vfsops.c,v 1.83 2009/03/15 17:22:38 cegger Exp $ */ /* $NetBSD: procfs_vfsops.c,v 1.84 2009/10/02 23:00:02 elad Exp $ */
/* /*
* Copyright (c) 1993 * Copyright (c) 1993
@ -76,7 +76,7 @@
*/ */
#include <sys/cdefs.h> #include <sys/cdefs.h>
__KERNEL_RCSID(0, "$NetBSD: procfs_vfsops.c,v 1.83 2009/03/15 17:22:38 cegger Exp $"); __KERNEL_RCSID(0, "$NetBSD: procfs_vfsops.c,v 1.84 2009/10/02 23:00:02 elad Exp $");
#if defined(_KERNEL_OPT) #if defined(_KERNEL_OPT)
#include "opt_compat_netbsd.h" #include "opt_compat_netbsd.h"
@ -110,6 +110,8 @@ VFS_PROTOS(procfs);
static struct sysctllog *procfs_sysctl_log; static struct sysctllog *procfs_sysctl_log;
static kauth_listener_t procfs_listener;
/* /*
* VFS Operations. * VFS Operations.
* *
@ -304,6 +306,45 @@ struct vfsops procfs_vfsops = {
{ NULL, NULL }, { NULL, NULL },
}; };
static int
procfs_listener_cb(kauth_cred_t cred, kauth_action_t action, void *cookie,
void *arg0, void *arg1, void *arg2, void *arg3)
{
struct proc *p;
struct pfsnode *pfs;
enum kauth_process_req req;
int result;
result = KAUTH_RESULT_DEFER;
p = arg0;
pfs = arg1;
req = (enum kauth_process_req)(unsigned long)arg2;
if (action != KAUTH_PROCESS_PROCFS)
return result;
/* Privileged; let secmodel handle that. */
if (req == KAUTH_REQ_PROCESS_PROCFS_CTL)
return result;
switch (pfs->pfs_type) {
case PFSregs:
case PFSfpregs:
case PFSmem:
if (kauth_cred_getuid(cred) != kauth_cred_getuid(p->p_cred) ||
ISSET(p->p_flag, PK_SUGID))
break;
/*FALLTHROUGH*/
default:
result = KAUTH_RESULT_ALLOW;
break;
}
return result;
}
static int static int
procfs_modcmd(modcmd_t cmd, void *arg) procfs_modcmd(modcmd_t cmd, void *arg)
{ {
@ -330,12 +371,17 @@ procfs_modcmd(modcmd_t cmd, void *arg)
* one more instance of the "number to vfs" mapping problem, * one more instance of the "number to vfs" mapping problem,
* but "12" is the order as taken from sys/mount.h * but "12" is the order as taken from sys/mount.h
*/ */
procfs_listener = kauth_listen_scope(KAUTH_SCOPE_PROCESS,
procfs_listener_cb, NULL);
break; break;
case MODULE_CMD_FINI: case MODULE_CMD_FINI:
error = vfs_detach(&procfs_vfsops); error = vfs_detach(&procfs_vfsops);
if (error != 0) if (error != 0)
break; break;
sysctl_teardown(&procfs_sysctl_log); sysctl_teardown(&procfs_sysctl_log);
kauth_unlisten_scope(procfs_listener);
break; break;
default: default:
error = ENOTTY; error = ENOTTY;

33
sys/secmodel/suser/secmodel_suser.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: secmodel_suser.c,v 1.7 2009/10/02 22:46:18 elad Exp $ */ /* $NetBSD: secmodel_suser.c,v 1.8 2009/10/02 23:00:02 elad Exp $ */
/*- /*-
* Copyright (c) 2006 Elad Efrat <elad@NetBSD.org> * Copyright (c) 2006 Elad Efrat <elad@NetBSD.org>
* All rights reserved. * All rights reserved.
@ -38,7 +38,7 @@
*/ */
#include <sys/cdefs.h> #include <sys/cdefs.h>
__KERNEL_RCSID(0, "$NetBSD: secmodel_suser.c,v 1.7 2009/10/02 22:46:18 elad Exp $"); __KERNEL_RCSID(0, "$NetBSD: secmodel_suser.c,v 1.8 2009/10/02 23:00:02 elad Exp $");
#include <sys/types.h> #include <sys/types.h>
#include <sys/param.h> #include <sys/param.h>
@ -574,36 +574,11 @@ secmodel_suser_process_cb(kauth_cred_t cred, kauth_action_t action,
break; break;
case KAUTH_PROCESS_PROCFS: { case KAUTH_PROCESS_PROCFS:
enum kauth_process_req req = (enum kauth_process_req)arg2; if (isroot)
struct pfsnode *pfs = arg1;
if (isroot) {
result = KAUTH_RESULT_ALLOW; result = KAUTH_RESULT_ALLOW;
break;
}
if (req == KAUTH_REQ_PROCESS_PROCFS_CTL) {
break;
}
switch (pfs->pfs_type) {
case PFSregs:
case PFSfpregs:
case PFSmem:
if (kauth_cred_getuid(cred) !=
kauth_cred_getuid(p->p_cred) ||
ISSET(p->p_flag, PK_SUGID)) {
break;
}
/*FALLTHROUGH*/
default:
result = KAUTH_RESULT_ALLOW;
break;
}
break; break;
}
case KAUTH_PROCESS_PTRACE: case KAUTH_PROCESS_PTRACE:
if (isroot) if (isroot)