Date: Thu, 3 Apr 2025 19:32:03 GMT From: Olivier Certner <olce@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Subject: git: 37a72b0ce427 - stable/14 - MAC/do: sysctl_rules(): Set the requesting's thread's jail's rules Message-ID: <202504031932.533JW3wd037429@gitrepo.freebsd.org>
next in thread | raw e-mail | index | archive | help
The branch stable/14 has been updated by olce: URL: https://cgit.FreeBSD.org/src/commit/?id=37a72b0ce4276ba9da54210638d714444c0e8100 commit 37a72b0ce4276ba9da54210638d714444c0e8100 Author: Olivier Certner <olce@FreeBSD.org> AuthorDate: 2024-07-03 12:59:12 +0000 Commit: Olivier Certner <olce@FreeBSD.org> CommitDate: 2025-04-03 19:30:58 +0000 MAC/do: sysctl_rules(): Set the requesting's thread's jail's rules Allowing to change the rules specification on a jail other than the requesting's thread one is a security issue, as it will immediately apply to the jail we inherited from and all its other descendants that inherit from it. With this change, setting the 'mdo_rules' sysctl in a jail forces that jail to no more inherit from its parent. Reviewed by: bapt Approved by: markj (mentor) Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D47601 (cherry picked from commit 53d2e0d4854997005271ee60791ab114bd6e0099) --- sys/security/mac_do/mac_do.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/sys/security/mac_do/mac_do.c b/sys/security/mac_do/mac_do.c index 94fe7b99fc9d..98bace7052f6 100644 --- a/sys/security/mac_do/mac_do.c +++ b/sys/security/mac_do/mac_do.c @@ -310,11 +310,12 @@ static int sysctl_rules(SYSCTL_HANDLER_ARGS) { char *const buf = malloc(MAC_RULE_STRING_LEN, M_DO, M_WAITOK); + struct prison *const td_pr = req->td->td_ucred->cr_prison; struct prison *pr; struct rules *rules; int error; - rules = find_rules(req->td->td_ucred->cr_prison, &pr); + rules = find_rules(td_pr, &pr); strlcpy(buf, rules->string, MAC_RULE_STRING_LEN); prison_unlock(pr); @@ -322,7 +323,8 @@ sysctl_rules(SYSCTL_HANDLER_ARGS) if (error != 0 || req->newptr == NULL) goto out; - error = parse_and_set_rules(pr, buf); + /* Set our prison's rules, not that of the jail we inherited from. */ + error = parse_and_set_rules(td_pr, buf); out: free(buf, M_DO); return (error);
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202504031932.533JW3wd037429>