Aren/NetBSD
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Some changes to get rid of another KAUTH_GENERIC_ISSUSER usage:

Browse Source 
- Make procfs_control() in procfs_ctl.c static,
  - Add an argument to the above, 'pfs', for the pfsnode,
  - Add another request type to KAUTH_PROCESS_CANPROCFS named
    KAUTH_REQ_PROCESS_CANPROCFS_CTL (and update documentation),
  - Use the above combination in a call to kauth_authorize_process().
This commit is contained in:
elad 2006-12-19 09:58:34 +00:00
parent 1f4ec449e9
commit f1a69ab3ea
3 changed files with 19 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
share/man/man9/kauth.9
View File

@ -1,4 +1,4 @@
.\" $NetBSD: kauth.9,v 1.38 2006/12/14 11:45:08 elad Exp $
.\" $NetBSD: kauth.9,v 1.39 2006/12/19 09:58:34 elad Exp $
.\"
.\" Copyright (c) 2005, 2006 Elad Efrat <elad@NetBSD.org>
.\" All rights reserved.
@ -28,7 +28,7 @@
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.\"
.Dd December 14, 2006
.Dd December 19, 2006
.Dt KAUTH 9
.Os
.Sh NAME
@ -279,11 +279,13 @@ is the
for the target element in the target process, and
.Ar arg2
is the access type, which can be either
.Dq KAUTH_REQ_PROCESS_CANPROCFS_CTL ,
.Dq KAUTH_REQ_PROCESS_CANPROCFS_READ ,
.Dq KAUTH_REQ_PROCESS_CANPROCFS_RW ,
or
.Dq KAUTH_REQ_PROCESS_CANPROCFS_WRITE ,
indicating
.Em control ,
.Em read ,
.Em read-write ,
or

24
sys/miscfs/procfs/procfs_ctl.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: procfs_ctl.c,v 1.37 2006/11/22 15:48:11 elad Exp $ */
/* $NetBSD: procfs_ctl.c,v 1.38 2006/12/19 09:58:35 elad Exp $ */
/*
* Copyright (c) 1993
@ -72,7 +72,7 @@
*/
#include <sys/cdefs.h>
__KERNEL_RCSID(0, "$NetBSD: procfs_ctl.c,v 1.37 2006/11/22 15:48:11 elad Exp $");
__KERNEL_RCSID(0, "$NetBSD: procfs_ctl.c,v 1.38 2006/12/19 09:58:35 elad Exp $");
#include <sys/param.h>
#include <sys/systm.h>
@ -126,13 +126,15 @@ static const vfs_namemap_t signames[] = {
{ NULL, 0 },
};
int procfs_control(struct lwp *, struct lwp *, int, int);
static int procfs_control(struct lwp *, struct lwp *, int, int,
struct pfsnode *);
int
procfs_control(curl, l, op, sig)
procfs_control(curl, l, op, sig, pfs)
struct lwp *curl;
struct lwp *l;
int op, sig;
struct pfsnode *pfs;
{
struct proc *curp = curl->l_proc;
struct proc *p = l->l_proc;
@ -164,13 +166,11 @@ procfs_control(curl, l, op, sig)
return (EBUSY);
/*
* (3) it's not owned by you, or is set-id on exec
* (unless you're root), or...
* (3) the security model prevents it.
*/
if ((kauth_cred_getuid(p->p_cred) != kauth_cred_getuid(curl->l_cred) ||
ISSET(p->p_flag, P_SUGID)) &&
(error = kauth_authorize_generic(curl->l_cred, KAUTH_GENERIC_ISSUSER,
&curl->l_acflag)) != 0)
if ((error = kauth_authorize_process(curl->l_cred,
KAUTH_PROCESS_CANPROCFS, p, pfs,
KAUTH_ARG(KAUTH_REQ_PROCESS_CANPROCFS_CTL), NULL)) != 0)
return (error);
break;
@ -349,14 +349,14 @@ procfs_doctl(
nm = vfs_findname(ctlnames, msg, xlen);
if (nm) {
error = procfs_control(curl, l, nm->nm_val, 0);
error = procfs_control(curl, l, nm->nm_val, 0, pfs);
} else {
nm = vfs_findname(signames, msg, xlen);
if (nm) {
if (ISSET(p->p_flag, P_TRACED) &&
p->p_pptr == p)
error = procfs_control(curl, l, PROCFS_CTL_RUN,
nm->nm_val);
nm->nm_val, pfs);
else {
psignal(p, nm->nm_val);
error = 0;

5
sys/sys/kauth.h
View File

@ -1,4 +1,4 @@
/* $NetBSD: kauth.h,v 1.26 2006/12/14 18:27:59 elad Exp $ */
/* $NetBSD: kauth.h,v 1.27 2006/12/19 09:58:35 elad Exp $ */
/*-
* Copyright (c) 2005, 2006 Elad Efrat <elad@NetBSD.org>
@ -132,7 +132,8 @@ enum {
* Process scope - sub-actions.
*/
enum kauth_process_req {
KAUTH_REQ_PROCESS_CANPROCFS_READ=1,
KAUTH_REQ_PROCESS_CANPROCFS_CTL=1,
KAUTH_REQ_PROCESS_CANPROCFS_READ,
KAUTH_REQ_PROCESS_CANPROCFS_RW,
KAUTH_REQ_PROCESS_CANPROCFS_WRITE,
KAUTH_REQ_PROCESS_RESOURCE_NICE,