From owner-freebsd-hackers@FreeBSD.ORG  Thu Jul 27 17:35:00 2006
Return-Path: <owner-freebsd-hackers@FreeBSD.ORG>
X-Original-To: freebsd-hackers@freebsd.org
Delivered-To: freebsd-hackers@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id A32A416A505
	for <freebsd-hackers@freebsd.org>; Thu, 27 Jul 2006 17:35:00 +0000 (UTC)
	(envelope-from jhb@freebsd.org)
Received: from server.baldwin.cx (66-23-211-162.clients.speedfactory.net
	[66.23.211.162])
	by mx1.FreeBSD.org (Postfix) with ESMTP id D175243D46
	for <freebsd-hackers@freebsd.org>; Thu, 27 Jul 2006 17:34:59 +0000 (GMT)
	(envelope-from jhb@freebsd.org)
Received: from localhost.corp.yahoo.com (john@localhost [127.0.0.1])
	(authenticated bits=0)
	by server.baldwin.cx (8.13.4/8.13.4) with ESMTP id k6RHYrn5078521;
	Thu, 27 Jul 2006 13:34:58 -0400 (EDT) (envelope-from jhb@freebsd.org)
From: John Baldwin <jhb@freebsd.org>
To: freebsd-hackers@freebsd.org
Date: Thu, 27 Jul 2006 11:28:19 -0400
User-Agent: KMail/1.9.1
References: <de71d27b0607231907o6a7567bdy81e1a6d613b88c82@mail.gmail.com>
In-Reply-To: <de71d27b0607231907o6a7567bdy81e1a6d613b88c82@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain;
  charset="utf-8"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
Message-Id: <200607271128.20025.jhb@freebsd.org>
X-Greylist: Sender succeeded SMTP AUTH authentication, not delayed by
	milter-greylist-2.0.2 (server.baldwin.cx [127.0.0.1]);
	Thu, 27 Jul 2006 13:34:59 -0400 (EDT)
X-Virus-Scanned: ClamAV 0.87.1/1623/Wed Jul 26 18:35:11 2006 on
	server.baldwin.cx
X-Virus-Status: Clean
X-Spam-Status: No, score=-4.4 required=4.2 tests=ALL_TRUSTED,AWL,BAYES_00 
	autolearn=ham version=3.1.0
X-Spam-Checker-Version: SpamAssassin 3.1.0 (2005-09-13) on server.baldwin.cx
Cc: =?utf-8?q?=E6=9D=8E=E5=B0=9A=E6=9D=B0?= <shangjie.li@gmail.com>
Subject: Re: A question about ipcperm() call?
X-BeenThere: freebsd-hackers@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Technical Discussions relating to FreeBSD
	<freebsd-hackers.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-hackers>, 
	<mailto:freebsd-hackers-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-hackers>
List-Post: <mailto:freebsd-hackers@freebsd.org>
List-Help: <mailto:freebsd-hackers-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-hackers>,
	<mailto:freebsd-hackers-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 27 Jul 2006 17:35:00 -0000

On Sunday 23 July 2006 22:07, =E6=9D=8E=E5=B0=9A=E6=9D=B0 wrote:
> The code for ipcperm() call :

>  93                 if (mode & IPC_M) {
>  94                         error =3D suser(td);
>  95                         if (error)
>  96                                 return (error);
>  97                 }

> 116         if ((mode & perm->mode) !=3D mode) {
> 117                 if (suser(td) !=3D 0)
> 118                         return (EACCES);
> 119         }
>=20
> why not directly return the error in line 94?

If suser() returns 0 and you just did 'return(suser(td))' then you would no=
t=20
perform the additional security check in lines 116-119 which could result i=
n=20
allowing access to an IPC object when it should be restricted.

=2D-=20
John Baldwin