Date: Wed, 3 Feb 2010 15:29:49 GMT From: Robert Watson <rwatson@FreeBSD.org> To: Perforce Change Reviews <perforce@freebsd.org> Subject: PERFORCE change 174240 for review Message-ID: <201002031529.o13FTnRr069773@repoman.freebsd.org>
next in thread | raw e-mail | index | archive | help
http://p4web.freebsd.org/chv.cgi?CH=174240 Change 174240 by rwatson@rwatson_vimage_client on 2010/02/03 15:29:13 Further constrain sandboxed tcpdump: don't allow excessive access to stdin, stdout, and stderr. Affected files ... .. //depot/projects/trustedbsd/capabilities/src/contrib/tcpdump/tcpdump.c#6 edit .. //depot/projects/trustedbsd/capabilities/src/usr.sbin/tcpdump/tcpdump/Makefile#3 edit Differences ... ==== //depot/projects/trustedbsd/capabilities/src/contrib/tcpdump/tcpdump.c#6 (text+ko) ==== @@ -77,6 +77,7 @@ #endif /* WIN32 */ #include <sys/capability.h> +#include <libcapsicum.h> #include "netdissect.h" #include "interface.h" @@ -1198,6 +1199,12 @@ (void)fflush(stderr); } #endif /* WIN32 */ + if (lc_limitfd(STDIN_FILENO, CAP_FSTAT) < 0) + error("lc_limitfd: unable to limit STDIN_FILENO"); + if (lc_limitfd(STDOUT_FILENO, CAP_FSTAT | CAP_SEEK | CAP_WRITE) < 0) + error("lc_limitfd: unable to limit STDIN_FILENO"); + if (lc_limitfd(STDERR_FILENO, CAP_FSTAT | CAP_SEEK | CAP_WRITE) < 0) + error("lc_limitfd: unable to limit STDIN_FILENO"); if (cap_enter() < 0) error("cap_enter: %s", pcap_strerror(errno)); status = pcap_loop(pd, cnt, callback, pcap_userdata); ==== //depot/projects/trustedbsd/capabilities/src/usr.sbin/tcpdump/tcpdump/Makefile#3 (text+ko) ==== @@ -50,8 +50,8 @@ CFLAGS+= -DLBL_ALIGN .endif -DPADD= ${LIBL} ${LIBPCAP} -LDADD= -ll -lpcap +DPADD= ${LIBL} ${LIBPCAP} ${LIBCAPSICUM} +LDADD= -ll -lpcap -lcapsicum .if ${MK_OPENSSL} != "no" && !defined(RELEASE_CRUNCH) DPADD+= ${LIBCRYPTO} LDADD+= -lcrypto
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201002031529.o13FTnRr069773>