From owner-p4-projects@FreeBSD.ORG  Mon Oct 17 19:53:19 2005
Return-Path: <owner-p4-projects@FreeBSD.ORG>
X-Original-To: p4-projects@freebsd.org
Delivered-To: p4-projects@freebsd.org
Received: by hub.freebsd.org (Postfix, from userid 32767)
	id A0AF416A421; Mon, 17 Oct 2005 19:53:18 +0000 (GMT)
X-Original-To: perforce@freebsd.org
Delivered-To: perforce@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 3A20C16A41F;
	Mon, 17 Oct 2005 19:53:18 +0000 (GMT) (envelope-from jhb@freebsd.org)
Received: from mv.twc.weather.com (mv.twc.weather.com [65.212.71.225])
	by mx1.FreeBSD.org (Postfix) with ESMTP id F1C4243D81;
	Mon, 17 Oct 2005 19:53:15 +0000 (GMT) (envelope-from jhb@freebsd.org)
Received: from [10.50.41.234] (Not Verified[10.50.41.234]) by
	mv.twc.weather.com with NetIQ MailMarshal (v6, 0, 3, 8)
	id <B435405090001>; Mon, 17 Oct 2005 16:09:45 -0400
From: John Baldwin <jhb@freebsd.org>
To: Robert Watson <rwatson@freebsd.org>
Date: Mon, 17 Oct 2005 15:38:30 -0400
User-Agent: KMail/1.8.2
References: <200510171542.j9HFgRhI073994@repoman.freebsd.org>
In-Reply-To: <200510171542.j9HFgRhI073994@repoman.freebsd.org>
MIME-Version: 1.0
Content-Type: text/plain;
  charset="iso-8859-6"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
Message-Id: <200510171538.30876.jhb@freebsd.org>
Cc: Perforce Change Reviews <perforce@freebsd.org>
Subject: Re: PERFORCE change 85448 for review
X-BeenThere: p4-projects@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: p4 projects tree changes <p4-projects.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/p4-projects>,
	<mailto:p4-projects-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/p4-projects>
List-Post: <mailto:p4-projects@freebsd.org>
List-Help: <mailto:p4-projects-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/p4-projects>,
	<mailto:p4-projects-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Mon, 17 Oct 2005 19:53:19 -0000

On Monday 17 October 2005 11:42 am, Robert Watson wrote:
> http://perforce.freebsd.org/chv.cgi?CH=85448
>
> Change 85448 by rwatson@rwatson_zoo on 2005/10/17 15:41:26
>
> 	In execve(), audit the path name being executed.  Annotate that it
> 	would also be good to audit the pathname of the interpreter, if
> 	any.

It's not a huge deal to do that you know, add the AUDITVNPATH1 flag to the 
various name lookups in imgact_foo.c

> Affected files ...
>
> .. //depot/projects/trustedbsd/audit3/sys/kern/kern_exec.c#5 edit
>
> Differences ...
>
> ==== //depot/projects/trustedbsd/audit3/sys/kern/kern_exec.c#5 (text+ko)
> ====
>
> @@ -350,10 +350,13 @@
>  	/*
>  	 * Translate the file name. namei() returns a vnode pointer
>  	 *	in ni_vp amoung other things.
> +	 *
> +	 * XXXAUDIT: It would be desirable to also audit the name of the
> +	 * interpreter if this is an interpreted binary.
>  	 */
>  	ndp = &nd;
> -	NDINIT(ndp, LOOKUP, ISOPEN | LOCKLEAF | FOLLOW | SAVENAME | MPSAFE,
> -	    UIO_SYSSPACE, args->fname, td);
> +	NDINIT(ndp, LOOKUP, ISOPEN | LOCKLEAF | FOLLOW | SAVENAME | MPSAFE |
> +	    AUDITVNPATH1, UIO_SYSSPACE, args->fname, td);
>
>  interpret:
>  	error = namei(ndp);

-- 
John Baldwin <jhb@FreeBSD.org>  <><  http://www.FreeBSD.org/~jhb/
"Power Users Use the Power to Serve"  =  http://www.FreeBSD.org