From owner-svn-src-head@FreeBSD.ORG  Fri Sep  6 18:59:19 2013
Return-Path: <owner-svn-src-head@FreeBSD.ORG>
Delivered-To: svn-src-head@FreeBSD.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))
 (No client certificate requested)
 by hub.freebsd.org (Postfix) with ESMTP id 1805EB0A;
 Fri,  6 Sep 2013 18:59:19 +0000 (UTC)
 (envelope-from jamie@FreeBSD.org)
Received: from m2.gritton.org (gritton.org [199.192.164.235])
 (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
 (No client certificate requested)
 by mx1.freebsd.org (Postfix) with ESMTPS id E9B0326EE;
 Fri,  6 Sep 2013 18:59:18 +0000 (UTC)
Received: from guppy.corp.verio.net (fw.oremut02.us.wh.verio.net
 [198.65.168.24]) (authenticated bits=0)
 by m2.gritton.org (8.14.5/8.14.5) with ESMTP id r86IxBqe092405;
 Fri, 6 Sep 2013 12:59:12 -0600 (MDT)
 (envelope-from jamie@FreeBSD.org)
Message-ID: <522A25FA.5060008@FreeBSD.org>
Date: Fri, 06 Sep 2013 12:59:06 -0600
From: Jamie Gritton <jamie@FreeBSD.org>
User-Agent: Mozilla/5.0 (X11; FreeBSD amd64;
 rv:17.0) Gecko/20130807 Thunderbird/17.0.7
MIME-Version: 1.0
To: Gleb Smirnoff <glebius@FreeBSD.org>
Subject: Re: svn commit: r255316 - head/sys/kern
References: <201309061732.r86HWTha054904@svn.freebsd.org>
 <20130906181826.GL4574@FreeBSD.org>
In-Reply-To: <20130906181826.GL4574@FreeBSD.org>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Cc: svn-src-head@FreeBSD.org, svn-src-all@FreeBSD.org,
 src-committers@FreeBSD.org
X-BeenThere: svn-src-head@freebsd.org
X-Mailman-Version: 2.1.14
Precedence: list
List-Id: SVN commit messages for the src tree for head/-current
 <svn-src-head.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/svn-src-head>,
 <mailto:svn-src-head-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/svn-src-head>
List-Post: <mailto:svn-src-head@freebsd.org>
List-Help: <mailto:svn-src-head-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/svn-src-head>,
 <mailto:svn-src-head-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Fri, 06 Sep 2013 18:59:19 -0000

On 09/06/13 12:18, Gleb Smirnoff wrote:
> On Fri, Sep 06, 2013 at 05:32:29PM +0000, Jamie Gritton wrote:
> J> Author: jamie
> J> Date: Fri Sep  6 17:32:29 2013
> J> New Revision: 255316
> J> URL: http://svnweb.freebsd.org/changeset/base/255316
> J> 
> J> Log:
> J>   Keep PRIV_KMEM_READ permitted inside jails as it is on the outside.
> J> 
> J> Modified:
> J>   head/sys/kern/kern_jail.c
> J> 
> J> Modified: head/sys/kern/kern_jail.c
> J> ==============================================================================
> J> --- head/sys/kern/kern_jail.c	Fri Sep  6 17:19:57 2013	(r255315)
> J> +++ head/sys/kern/kern_jail.c	Fri Sep  6 17:32:29 2013	(r255316)
> J> @@ -3885,6 +3885,13 @@ prison_priv_check(struct ucred *cred, in
> J>  	case PRIV_VFS_SETGID:
> J>  	case PRIV_VFS_STAT:
> J>  	case PRIV_VFS_STICKYFILE:
> J> +
> J> +		/*
> J> +		 * As in the non-jail case, non-root users are expected to be
> J> +		 * able to read kernel/phyiscal memory (provided /dev/[k]mem
> J> +		 * exists in the jail and they have permission to access it).
> J> +		 */
> J> +	case PRIV_KMEM_READ:
> J>  		return (0);
> J>  
> J>  		/*
> 
> Was that discussed anywhere or reviewed by anyone?

Yes, it was brought up by jase@ in src-committers last week, noting that
my original PRIV_KMEM_* commit (r252841) broke existing jail behavior.
The entire "discussion" was the mention of the problem and my mention of
what it would take to fix it. There was no code review as such, but that
seemed appropriate for an obvious one-liner.

- Jamie