From owner-p4-projects@FreeBSD.ORG Wed Dec 2 13:41:38 2009 Return-Path: Delivered-To: p4-projects@freebsd.org Received: by hub.freebsd.org (Postfix, from userid 32767) id 1B73C1065676; Wed, 2 Dec 2009 13:41:38 +0000 (UTC) Delivered-To: perforce@FreeBSD.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 56DD0106566B for ; Wed, 2 Dec 2009 13:41:35 +0000 (UTC) (envelope-from jona@FreeBSD.org) Received: from repoman.freebsd.org (repoman.freebsd.org [IPv6:2001:4f8:fff6::29]) by mx1.freebsd.org (Postfix) with ESMTP id 444E88FC17 for ; Wed, 2 Dec 2009 13:41:35 +0000 (UTC) Received: from repoman.freebsd.org (localhost [127.0.0.1]) by repoman.freebsd.org (8.14.3/8.14.3) with ESMTP id nB2DfZdn047300 for ; Wed, 2 Dec 2009 13:41:35 GMT (envelope-from jona@FreeBSD.org) Received: (from perforce@localhost) by repoman.freebsd.org (8.14.3/8.14.3/Submit) id nB2DfZhe047298 for perforce@freebsd.org; Wed, 2 Dec 2009 13:41:35 GMT (envelope-from jona@FreeBSD.org) Date: Wed, 2 Dec 2009 13:41:35 GMT Message-Id: <200912021341.nB2DfZhe047298@repoman.freebsd.org> X-Authentication-Warning: repoman.freebsd.org: perforce set sender to jona@FreeBSD.org using -f From: Jonathan Anderson To: Perforce Change Reviews Precedence: bulk Cc: Subject: PERFORCE change 171267 for review X-BeenThere: p4-projects@freebsd.org X-Mailman-Version: 2.1.5 List-Id: p4 projects tree changes List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 02 Dec 2009 13:41:38 -0000 http://p4web.freebsd.org/chv.cgi?CH=171267 Change 171267 by jona@jona-capsicum-belle64-ufs on 2009/12/02 13:41:19 Enable faccessat(2) in capability mode Affected files ... .. //depot/projects/trustedbsd/capabilities/TODO#16 edit .. //depot/projects/trustedbsd/capabilities/src/sys/kern/capabilities.conf#23 edit .. //depot/projects/trustedbsd/capabilities/src/sys/kern/init_sysent.c#43 edit .. //depot/projects/trustedbsd/capabilities/src/sys/kern/vfs_syscalls.c#19 edit Differences ... ==== //depot/projects/trustedbsd/capabilities/TODO#16 (text+ko) ==== @@ -28,7 +28,7 @@ Low-level TODO list: - Add support for capability-mode *at() system calls: - faccessat INPROGRESS JA + faccessat DONE 2 Dec 2009 JA fchmodat ---- fchownat ---- fstatat ---- ==== //depot/projects/trustedbsd/capabilities/src/sys/kern/capabilities.conf#23 (text+ko) ==== @@ -38,7 +38,7 @@ ## - sys_exit(2), abort2(2) and close(2) are very important. ## - Sorted alphabetically, please keep it that way. ## -## $P4: //depot/projects/trustedbsd/capabilities/src/sys/kern/capabilities.conf#22 $ +## $P4: //depot/projects/trustedbsd/capabilities/src/sys/kern/capabilities.conf#23 $ ## ## @@ -453,9 +453,10 @@ olio_listio ## -## Allow openat(2), which we have constrained to prevent accessing files -## which are not "under" the directory FD given to the syscall. +## Allow faccessat(2) and openat(2), which we have constrained to prevent accessing +## files which are not "under" the directory FD given to the syscall. ## +faccessat openat ## ==== //depot/projects/trustedbsd/capabilities/src/sys/kern/init_sysent.c#43 (text+ko) ==== @@ -523,7 +523,7 @@ { AS(cpuset_getid_args), (sy_call_t *)cpuset_getid, AUE_NULL, NULL, 0, 0, 0 }, /* 486 = cpuset_getid */ { AS(cpuset_getaffinity_args), (sy_call_t *)cpuset_getaffinity, AUE_NULL, NULL, 0, 0, 0 }, /* 487 = cpuset_getaffinity */ { AS(cpuset_setaffinity_args), (sy_call_t *)cpuset_setaffinity, AUE_NULL, NULL, 0, 0, 0 }, /* 488 = cpuset_setaffinity */ - { AS(faccessat_args), (sy_call_t *)faccessat, AUE_FACCESSAT, NULL, 0, 0, 0 }, /* 489 = faccessat */ + { AS(faccessat_args), (sy_call_t *)faccessat, AUE_FACCESSAT, NULL, 0, 0, SYF_CAPENABLED }, /* 489 = faccessat */ { AS(fchmodat_args), (sy_call_t *)fchmodat, AUE_FCHMODAT, NULL, 0, 0, 0 }, /* 490 = fchmodat */ { AS(fchownat_args), (sy_call_t *)fchownat, AUE_FCHOWNAT, NULL, 0, 0, 0 }, /* 491 = fchownat */ { AS(fexecve_args), (sy_call_t *)fexecve, AUE_FEXECVE, NULL, 0, 0, SYF_CAPENABLED }, /* 492 = fexecve */ ==== //depot/projects/trustedbsd/capabilities/src/sys/kern/vfs_syscalls.c#19 (text+ko) ==== @@ -2219,7 +2219,7 @@ int flags, int mode) { struct ucred *cred, *tmpcred; - struct vnode *vp; + struct vnode *vp, *base = 0; struct nameidata nd; int vfslocked; int error; @@ -2238,8 +2238,25 @@ } else cred = tmpcred = td->td_ucred; AUDIT_ARG_VALUE(mode); - NDINIT_AT(&nd, LOOKUP, FOLLOW | LOCKSHARED | LOCKLEAF | MPSAFE | - AUDITVNODE1, pathseg, path, fd, td); + + /* + * if a relative base was specified and we're in capability mode, find + * the vnode of the base so that namei() can restrict itself accordingly + */ + if ((cred->cr_flags & CRED_FLAG_CAPMODE) && (fd >= 0)) { + + if ((error = fgetvp(td, fd, CAP_LOOKUP | CAP_ATBASE, &base))) + /* XXX: more CAP_FOO? */ + return (error); + + if ((error = vn_lock(base, LK_SHARED))) { + vrele (base); + return (error); + } + } + + NDINIT_ATBASE(&nd, LOOKUP, FOLLOW | LOCKSHARED | LOCKLEAF | MPSAFE | + AUDITVNODE1, pathseg, path, fd, base, td); if ((error = namei(&nd)) != 0) goto out1; vfslocked = NDHASGIANT(&nd); @@ -2254,6 +2271,7 @@ td->td_ucred = cred; crfree(tmpcred); } + if (base) vput(base); return (error); }