Date: Thu, 27 Jul 2006 11:28:19 -0400 From: John Baldwin <jhb@freebsd.org> To: freebsd-hackers@freebsd.org Cc: =?utf-8?q?=E6=9D=8E=E5=B0=9A=E6=9D=B0?= <shangjie.li@gmail.com> Subject: Re: A question about ipcperm() call? Message-ID: <200607271128.20025.jhb@freebsd.org> In-Reply-To: <de71d27b0607231907o6a7567bdy81e1a6d613b88c82@mail.gmail.com> References: <de71d27b0607231907o6a7567bdy81e1a6d613b88c82@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Sunday 23 July 2006 22:07, =E6=9D=8E=E5=B0=9A=E6=9D=B0 wrote:
> The code for ipcperm() call :
> 93 if (mode & IPC_M) {
> 94 error =3D suser(td);
> 95 if (error)
> 96 return (error);
> 97 }
> 116 if ((mode & perm->mode) !=3D mode) {
> 117 if (suser(td) !=3D 0)
> 118 return (EACCES);
> 119 }
>=20
> why not directly return the error in line 94?
If suser() returns 0 and you just did 'return(suser(td))' then you would no=
t=20
perform the additional security check in lines 116-119 which could result i=
n=20
allowing access to an IPC object when it should be restricted.
=2D-=20
John Baldwin
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200607271128.20025.jhb>