From owner-svn-src-projects@FreeBSD.ORG Thu Dec 6 20:31:58 2012 Return-Path: Delivered-To: svn-src-projects@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id 69CAE2EF; Thu, 6 Dec 2012 20:31:58 +0000 (UTC) (envelope-from jkim@FreeBSD.org) Received: from hammer.pct.niksun.com (freefall.freebsd.org [IPv6:2001:1900:2254:206c::16:87]) by mx1.freebsd.org (Postfix) with ESMTP id D17C08FC08; Thu, 6 Dec 2012 20:31:57 +0000 (UTC) Message-ID: <50C1007E.6000304@FreeBSD.org> Date: Thu, 06 Dec 2012 15:30:54 -0500 From: Jung-uk Kim User-Agent: Mozilla/5.0 (X11; FreeBSD amd64; rv:17.0) Gecko/17.0 Thunderbird/17.0 MIME-Version: 1.0 To: Eitan Adler Subject: Re: svn commit: r243914 - projects/bpfjit References: <201212052312.qB5NC2Hn056351@svn.freebsd.org> <20121206084936.GA58940@freebsd.org> <50C0DFB0.6030007@FreeBSD.org> In-Reply-To: X-Enigmail-Version: 1.4.6 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Cc: svn-src-projects@freebsd.org, Roman Divacky , src-committers@freebsd.org X-BeenThere: svn-src-projects@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: "SVN commit messages for the src " projects" tree" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 06 Dec 2012 20:31:58 -0000 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 2012-12-06 14:53:15 -0500, Eitan Adler wrote: > On 6 December 2012 13:10, Jung-uk Kim wrote: >> , i.e., all you need is read permission to inject code to kernel >> space. > > Could you explain what you mean here? % ls -l /dev/bpf crw-r----- 1 root wheel 0x8 12 5 17:08 /dev/bpf % id -Gn staff wheel Note I only have read access to /dev/bpf. % ktrace tcpdump -i re0 -n -c 1 host xxx.xxx.xxx.xxx > /dev/null tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on re0, link-type EN10MB (Ethernet), capture size 65535 bytes 1 packet captured 11 packets received by filter 0 packets dropped by kernel % kdump | grep ioctl ... 6615 tcpdump CALL ioctl(0x3,BIOCSETF,0x7fffffffd148) 6615 tcpdump RET ioctl 0 ... 6615 tcpdump CALL ioctl(0x3,BIOCSETF,0x7fffffffd2b0) 6615 tcpdump RET ioctl 0 ... The first one sets the default read filter. The second one sets my read filter. If we implement another command to upload the native machine code, it will be very much like this. Of course, we can only allow it for root but it will not be very useful. Jung-uk Kim -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.19 (FreeBSD) iQEcBAEBAgAGBQJQwQB+AAoJECXpabHZMqHOYfsH/RYDEjdLGo9PkkrouFnWAymj Yi3FwUixkLVGfa2l59MVWcoMX/+gb44HXYLbMREaljdNQ32LY2P6/Pl3tsVKBVex HHqIT9zbq4wCP1U5dIEbH1ra5ff+0eDOG3jPFWgG6b8fX4b9ey7uS606GaeFSkpm py7jO2BsSHe32bImGJvA6QhVYmea0H15yNxn358ZVqMJvHUDN3yxSvRgHOU9jUFW KhIsRj9/VpspSzvPL2AGCKd50N3u4/gi1O1w07OgIUMbXGWIvxSwahYL1Dra3qD5 1hRNbZGgq5g1+SoDrZzs2JrjwF7X32zo1L0GW40BXGJhdQTu/iMlZEEn4eiS9K4= =dO58 -----END PGP SIGNATURE-----