From owner-freebsd-security@freebsd.org Tue Sep 26 22:06:31 2017 Return-Path: Delivered-To: freebsd-security@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id E19ACE234D5 for ; Tue, 26 Sep 2017 22:06:31 +0000 (UTC) (envelope-from shawn.webb@hardenedbsd.org) Received: from mail-wm0-x22f.google.com (mail-wm0-x22f.google.com [IPv6:2a00:1450:400c:c09::22f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G2" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 70E6D7CAF5 for ; Tue, 26 Sep 2017 22:06:31 +0000 (UTC) (envelope-from shawn.webb@hardenedbsd.org) Received: by mail-wm0-x22f.google.com with SMTP id q124so12243554wmb.0 for ; Tue, 26 Sep 2017 15:06:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hardenedbsd-org.20150623.gappssmtp.com; s=20150623; h=date:from:to:cc:subject:message-id:references:mime-version :content-disposition:in-reply-to:user-agent; bh=oXKBpz6IrorrArOu2IDtvkIZv1jWqQMp+Cu6XqO3JkA=; b=H7zXuVhDixQIv2GH8LxuVA/EdP1A7Bb5PrF7TKPJoesY+x6s1gx6ZyRAiVlL6Dvi+f iI2tM3lzORXXjoh3EQvBNhIGCxy9vhh1Vr0dOoKI/ifvyvwzfOb8ap3fuWd4/n5JSYof EYZRCpequ2KzUKrAUNPpSCPGCEAwX3KFQ3QfJI5IcCWo+O+hyoJDD18nBrwKM2FArZbV EDFqr4q7QfkH13NmjOpMoR69FzCKabAP8RXH/+qXgF9oTsgBMGvknrosNjMT72udLd8u oyXtM53kGvSBQ0otL33ppTJLTD1hzqwwOLEHI17t51qZtnWwmIA8c3ekfJC048pKejtA QFqw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:from:to:cc:subject:message-id:references :mime-version:content-disposition:in-reply-to:user-agent; bh=oXKBpz6IrorrArOu2IDtvkIZv1jWqQMp+Cu6XqO3JkA=; b=ZqsYVScnj9QxtQT6AAnlvulFWATcPTVWGRaoxfdINgh1sgMCzGSBj51SSv8FqC0CRm Etx63drT5ITv9+NijSvjnCVZP1fVPaOEAQ6WNNJqVBxbnIHfI37JbLgVBFs6ZvHCpFZM XUkvX895V7Y18mfsYHeSz1B7rgqEqQKj8S04yO1FLxZZcS+0L3jK1R0HfKL1WJcH6iro QRvn/t3CtRt7TUFeKiTJwmdVOM/l5nw/pAAKWa3FVCjZFNyrIJVuFIJIOesaQJdtJqoJ Jr5/V4Jw3h5HjYsdC/yhGFVxe6mIz2RycBLQAL/SfVjf0ccRR2qAFawRAh2QdsJglAIY eY6g== X-Gm-Message-State: AHPjjUgRhfNB/imLToAHyquTzSGb6DRMJS211Qxi7cHRzphcyz6UjOfE IUERgwVhdR7bmKe4XJDwchDBgYLwxLY= X-Google-Smtp-Source: AOwi7QB0GnVIVislLuXJQwxQLsWFt+AYLYrTJkxoArb4n02npsmP2SBAVKJBdLkncvt6aXMgJtyvXA== X-Received: by 10.28.218.209 with SMTP id r200mr4089625wmg.97.1506463589078; Tue, 26 Sep 2017 15:06:29 -0700 (PDT) Received: from mutt-hbsd (tor-exit-readme.memcpy.io. [163.172.67.180]) by smtp.gmail.com with ESMTPSA id n9sm4246625wmd.12.2017.09.26.15.06.23 (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Tue, 26 Sep 2017 15:06:24 -0700 (PDT) Date: Tue, 26 Sep 2017 18:06:15 -0400 From: Shawn Webb To: Ben Laurie Cc: "freebsd-security@freebsd.org security" Subject: Re: Capsicum and connect(2) Message-ID: <20170926220615.qd5e5pzmgmkrdg3x@mutt-hbsd> References: <20170926193753.eolxa6lk5qvejtgc@mutt-hbsd> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="rzfg4urtcvrq6tkd" Content-Disposition: inline In-Reply-To: X-Operating-System: FreeBSD mutt-hbsd 12.0-CURRENT FreeBSD 12.0-CURRENT X-PGP-Key: http://pgp.mit.edu/pks/lookup?op=vindex&search=0x6A84658F52456EEE User-Agent: NeoMutt/20170912 (1.9.0) X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 26 Sep 2017 22:06:32 -0000 --rzfg4urtcvrq6tkd Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Perhaps. But if the file descriptor is given the CAP_CONNECT capability, I should be able to call connect(2) on it, right? The manpage for connect(2) does not state that connect(2) is fully disallowed, even if CAP_CONNECT is a granted capability. On Tue, Sep 26, 2017 at 10:02:53PM +0000, Ben Laurie wrote: > ECAPMODE means the syscall is forbidden, surely? >=20 > On 26 September 2017 at 20:37, Shawn Webb wr= ote: > > Hey All, > > > > I'm working on applying Capsicum to Tor. I've got a PoC design for how > > I'm going to do it posted here: > > > > https://github.com/lattera/PoCs/tree/master/capsicum_fdpassing > > > > Note that the above code might have ugly spots. It's mostly just a brain > > dump. > > > > Essentially, the child process creates the socket and passes the > > socket's file descriptor back to the parent. The socket file descriptor > > has the capabilities sets already applied to it before it goes back to > > the parent. The socket creation and file descriptor passing seems to > > work well. > > > > However, what isn't working is calling connect(2) on the socket file > > descriptor in the parent. errno gets set to ECAPMODE. This is puzzling > > to me since CAP_CONNECT is set on the descriptor. > > > > Any help would be appreciated. > > > > Thanks, > > > > -- > > Shawn Webb > > Cofounder and Security Engineer > > HardenedBSD > > > > GPG Key ID: 0x6A84658F52456EEE > > GPG Key Fingerprint: 2ABA B6BD EF6A F486 BE89 3D9E 6A84 658F 5245 6EEE --=20 Shawn Webb Cofounder and Security Engineer HardenedBSD GPG Key ID: 0x6A84658F52456EEE GPG Key Fingerprint: 2ABA B6BD EF6A F486 BE89 3D9E 6A84 658F 5245 6EEE --rzfg4urtcvrq6tkd Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEKrq2ve9q9Ia+iT2eaoRlj1JFbu4FAlnKz1QACgkQaoRlj1JF bu733w/+IVGgbh9H//ckTZUcfBQfonroG7rC9uEU5cg7GGm9PAtrAps3s/54W0NC SRhi8RIkjdOelyuNYy67uUHk2SCycrPR0QTKIHwTHFoPsngK5oJh266c4f1vJyKE HDCxg6CdrvqRTZfn0QKS7GEJFBxcn3Vj9Zbk8s4YaZGMfm7X7T0rTS8xgytHQPX7 wvBxw/VEM5expMtXJkSwqhabUwx2NoRvRZDtZGnZsjd4GUtvY8xK5A3gwa8ae8hH ztsniEQCrY8TzfuR9NvEkVIAjR3aFFPulMNlfr6TQFUseOf9nI5HXxA1NJsk5ZX5 QJhJdzLKDgwNAlSPFZXatSQMC93V5RCp90akqfLsaIo5V1HdvLlifCzdtjl+ItuW P+mkr0ccDZnyJxZa/1XS3FLE1vbBo2pmro65C0Mt2vt5XUaIoIRXNwKEkbZvONLy E2sA8bXZax9oV4lWh2mfB5MlpzR/4ePu92QwmU3UUpiJ2HZAEOQesLr6r3xIstGM 5I/vaFJHG0dgyChDN4gFLjrpE9IPx4Fgc3oh11md//0S5ZXyT1nyKxZVyL221boZ J9mVAzLnTevNnxpclfwTS0zxOhnxQwbPDMdxsu11jRkBRMfk9QeX52gAJEjPe8Sj uw1NstAIGwLjdgqSe4dR2iJukA1th7FdvWJm7ZCWYiwHYmroIvA= =wqJu -----END PGP SIGNATURE----- --rzfg4urtcvrq6tkd--