From owner-svn-src-projects@FreeBSD.ORG Sun Jul 26 07:48:22 2009 Return-Path: Delivered-To: svn-src-projects@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 80759106564A; Sun, 26 Jul 2009 07:48:22 +0000 (UTC) (envelope-from stas@FreeBSD.org) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:4f8:fff6::2c]) by mx1.freebsd.org (Postfix) with ESMTP id 63BDF8FC16; Sun, 26 Jul 2009 07:48:22 +0000 (UTC) (envelope-from stas@FreeBSD.org) Received: from svn.freebsd.org (localhost [127.0.0.1]) by svn.freebsd.org (8.14.3/8.14.3) with ESMTP id n6Q7mMtl063475; Sun, 26 Jul 2009 07:48:22 GMT (envelope-from stas@svn.freebsd.org) Received: (from stas@localhost) by svn.freebsd.org (8.14.3/8.14.3/Submit) id n6Q7mMUK063471; Sun, 26 Jul 2009 07:48:22 GMT (envelope-from stas@svn.freebsd.org) Message-Id: <200907260748.n6Q7mMUK063471@svn.freebsd.org> From: Stanislav Sedov Date: Sun, 26 Jul 2009 07:48:22 +0000 (UTC) To: src-committers@freebsd.org, svn-src-projects@freebsd.org X-SVN-Group: projects MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Cc: Subject: svn commit: r195883 - projects/libprocstat/usr.bin/fstat X-BeenThere: svn-src-projects@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "SVN commit messages for the src " projects" tree" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 26 Jul 2009 07:48:22 -0000 Author: stas Date: Sun Jul 26 07:48:22 2009 New Revision: 195883 URL: http://svn.freebsd.org/changeset/base/195883 Log: - Install with setgid mode (required for sysctl access). - Discard setgid privilegies after file list retrieval. Modified: projects/libprocstat/usr.bin/fstat/Makefile projects/libprocstat/usr.bin/fstat/fstat.c projects/libprocstat/usr.bin/fstat/fuser.c Modified: projects/libprocstat/usr.bin/fstat/Makefile ============================================================================== --- projects/libprocstat/usr.bin/fstat/Makefile Sun Jul 26 06:38:56 2009 (r195882) +++ projects/libprocstat/usr.bin/fstat/Makefile Sun Jul 26 07:48:22 2009 (r195883) @@ -8,6 +8,8 @@ SRCS= cd9660.c common_kvm.c fstat.c fuse LINKS= ${BINDIR}/fstat ${BINDIR}/fuser DPADD= ${LIBKVM} LDADD= -lkvm -lutil +BINGRP= kmem +BINMODE=2555 WARNS?= 6 MAN1= fuser.1 fstat.1 Modified: projects/libprocstat/usr.bin/fstat/fstat.c ============================================================================== --- projects/libprocstat/usr.bin/fstat/fstat.c Sun Jul 26 06:38:56 2009 (r195882) +++ projects/libprocstat/usr.bin/fstat/fstat.c Sun Jul 26 07:48:22 2009 (r195883) @@ -165,12 +165,19 @@ do_fstat(int argc, char **argv) checkfile = 1; } + /* + * Discard setgid privileges if not the running kernel so that bad + * guys can't print interesting stuff from kernel memory. + */ + if (nlistf != NULL || memf != NULL) + setgid(getgid()); procstat = procstat_open(nlistf, memf); if (procstat == NULL) errx(1, "procstat_open()"); p = procstat_getprocs(procstat, what, arg, &cnt); if (p == NULL) errx(1, "procstat_getprocs()"); + setgid(getgid()); /* * Print header. Modified: projects/libprocstat/usr.bin/fstat/fuser.c ============================================================================== --- projects/libprocstat/usr.bin/fstat/fuser.c Sun Jul 26 06:38:56 2009 (r195882) +++ projects/libprocstat/usr.bin/fstat/fuser.c Sun Jul 26 07:48:22 2009 (r195883) @@ -168,11 +168,11 @@ do_fuser(int argc, char *argv[]) struct reqfile *reqfiles; int ch, cnt, sig; unsigned int i, nfiles; - char *ep, *kernimg, *mcore; + char *ep, *nlistf, *memf; sig = SIGKILL; /* Default to kill. */ - kernimg = NULL; - mcore = NULL; + nlistf = NULL; + memf = NULL; while ((ch = getopt(argc, argv, "M:N:cfhkms:u")) != -1) switch(ch) { case 'f': @@ -186,10 +186,10 @@ do_fuser(int argc, char *argv[]) flags |= CFLAG; break; case 'N': - kernimg = optarg; + nlistf = optarg; break; case 'M': - mcore = optarg; + memf = optarg; break; case 'u': flags |= UFLAG; @@ -240,12 +240,19 @@ do_fuser(int argc, char *argv[]) if (nfiles == 0) errx(EX_IOERR, "files not accessible"); - procstat = procstat_open(kernimg, mcore); + /* + * Discard setgid privileges if not the running kernel so that bad + * guys can't print interesting stuff from kernel memory. + */ + if (nlistf != NULL || memf != NULL) + setgid(getgid()); + procstat = procstat_open(nlistf, memf); if (procstat == NULL) errx(1, "procstat_open()"); p = procstat_getprocs(procstat, KERN_PROC_PROC, 0, &cnt); if (p == NULL) errx(1, "procstat_getprocs()"); + setgid(getgid()); /* * Walk through process table and look for matching files.