Date: Thu, 3 Dec 2009 14:03:09 GMT From: Jonathan Anderson <jona@FreeBSD.org> To: Perforce Change Reviews <perforce@FreeBSD.org> Subject: PERFORCE change 171326 for review Message-ID: <200912031403.nB3E39I5038537@repoman.freebsd.org>
index | next in thread | raw e-mail
http://p4web.freebsd.org/chv.cgi?CH=171326 Change 171326 by jona@jona-capsicum-kent64 on 2009/12/03 14:03:05 Enable fchmodat(2) Affected files ... .. //depot/projects/trustedbsd/capabilities/src/sys/kern/capabilities.conf#24 edit .. //depot/projects/trustedbsd/capabilities/src/sys/kern/init_sysent.c#44 edit .. //depot/projects/trustedbsd/capabilities/src/sys/kern/vfs_syscalls.c#21 edit Differences ... ==== //depot/projects/trustedbsd/capabilities/src/sys/kern/capabilities.conf#24 (text+ko) ==== @@ -38,7 +38,7 @@ ## - sys_exit(2), abort2(2) and close(2) are very important. ## - Sorted alphabetically, please keep it that way. ## -## $P4: //depot/projects/trustedbsd/capabilities/src/sys/kern/capabilities.conf#23 $ +## $P4: //depot/projects/trustedbsd/capabilities/src/sys/kern/capabilities.conf#24 $ ## ## @@ -453,10 +453,11 @@ olio_listio ## -## Allow faccessat(2) and openat(2), which we have constrained to prevent accessing +## Allow some of the *at(2) calls, which we have constrained to prevent accessing ## files which are not "under" the directory FD given to the syscall. ## faccessat +fchmodat openat ## ==== //depot/projects/trustedbsd/capabilities/src/sys/kern/init_sysent.c#44 (text+ko) ==== @@ -524,7 +524,7 @@ { AS(cpuset_getaffinity_args), (sy_call_t *)cpuset_getaffinity, AUE_NULL, NULL, 0, 0, 0 }, /* 487 = cpuset_getaffinity */ { AS(cpuset_setaffinity_args), (sy_call_t *)cpuset_setaffinity, AUE_NULL, NULL, 0, 0, 0 }, /* 488 = cpuset_setaffinity */ { AS(faccessat_args), (sy_call_t *)faccessat, AUE_FACCESSAT, NULL, 0, 0, SYF_CAPENABLED }, /* 489 = faccessat */ - { AS(fchmodat_args), (sy_call_t *)fchmodat, AUE_FCHMODAT, NULL, 0, 0, 0 }, /* 490 = fchmodat */ + { AS(fchmodat_args), (sy_call_t *)fchmodat, AUE_FCHMODAT, NULL, 0, 0, SYF_CAPENABLED }, /* 490 = fchmodat */ { AS(fchownat_args), (sy_call_t *)fchownat, AUE_FCHOWNAT, NULL, 0, 0, 0 }, /* 491 = fchownat */ { AS(fexecve_args), (sy_call_t *)fexecve, AUE_FEXECVE, NULL, 0, 0, SYF_CAPENABLED }, /* 492 = fexecve */ { AS(fstatat_args), (sy_call_t *)fstatat, AUE_FSTATAT, NULL, 0, 0, 0 }, /* 493 = fstatat */ ==== //depot/projects/trustedbsd/capabilities/src/sys/kern/vfs_syscalls.c#21 (text+ko) ==== @@ -3042,13 +3042,20 @@ struct nameidata nd; int vfslocked; int follow; + struct vnode *base; AUDIT_ARG_MODE(mode); follow = (flag & AT_SYMLINK_NOFOLLOW) ? NOFOLLOW : FOLLOW; - NDINIT_AT(&nd, LOOKUP, follow | MPSAFE | AUDITVNODE1, pathseg, path, - fd, td); - if ((error = namei(&nd)) != 0) + if ((error = fgetbase(td, fd, CAP_FCHMOD, &base))) + return (error); + + NDINIT_ATBASE(&nd, LOOKUP, follow | MPSAFE | AUDITVNODE1, pathseg, path, + fd, base, td); + error = namei(&nd); + if (base) vput(base); + if (error) return (error); + vfslocked = NDHASGIANT(&nd); NDFREE(&nd, NDF_ONLY_PNBUF); error = setfmode(td, nd.ni_vp, mode);help
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200912031403.nB3E39I5038537>