Date: Mon, 26 Jul 2021 20:10:23 GMT From: Bryan Drewery <bdrewery@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org Subject: git: 372557d8c3d3 - main - dumpon: Fix -v causing error when configuring an encrypted dump Message-ID: <202107262010.16QKAN02022928@gitrepo.freebsd.org>
next in thread | raw e-mail | index | archive | help
The branch main has been updated by bdrewery: URL: https://cgit.FreeBSD.org/src/commit/?id=372557d8c3d37dd0c1d9be56513a436393963848 commit 372557d8c3d37dd0c1d9be56513a436393963848 Author: Bryan Drewery <bdrewery@FreeBSD.org> AuthorDate: 2021-07-22 00:37:03 +0000 Commit: Bryan Drewery <bdrewery@FreeBSD.org> CommitDate: 2021-07-26 20:08:59 +0000 dumpon: Fix -v causing error when configuring an encrypted dump If -v is specified when adding a new device then a full listing of configured devices is displayed. This requires sysctl access which genkey()'s use of capability mode was blocking permission to access. This leads to both confusing console spam but also incorrectly returning an error status even if no other had been encountered. dumpon: Sysctl get 'kern.shutdown.dumpdevname': Operation not permitted Fix this by generating the key in a child process. Reviewed by: markj Sponsored by: Dell EMC Differential Revision: https://reviews.freebsd.org/D31266 --- sbin/dumpon/dumpon.c | 47 ++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 46 insertions(+), 1 deletion(-) diff --git a/sbin/dumpon/dumpon.c b/sbin/dumpon/dumpon.c index 183ce5f08cb3..ef1eb3defc98 100644 --- a/sbin/dumpon/dumpon.c +++ b/sbin/dumpon/dumpon.c @@ -48,6 +48,7 @@ __FBSDID("$FreeBSD$"); #include <sys/disk.h> #include <sys/socket.h> #include <sys/sysctl.h> +#include <sys/wait.h> #include <assert.h> #include <capsicum_helpers.h> @@ -210,7 +211,7 @@ check_size(int fd, const char *fn) #ifdef HAVE_CRYPTO static void -genkey(const char *pubkeyfile, struct diocskerneldump_arg *kdap) +_genkey(const char *pubkeyfile, struct diocskerneldump_arg *kdap) { FILE *fp; RSA *pubkey; @@ -305,6 +306,50 @@ genkey(const char *pubkeyfile, struct diocskerneldump_arg *kdap) } RSA_free(pubkey); } + +/* + * Run genkey() in a child so it can use capability mode without affecting + * the rest of the runtime. + */ +static void +genkey(const char *pubkeyfile, struct diocskerneldump_arg *kdap) +{ + pid_t pid; + int error, filedes[2], status; + ssize_t bytes; + + if (pipe2(filedes, O_CLOEXEC) != 0) + err(1, "pipe"); + pid = fork(); + switch (pid) { + case -1: + err(1, "fork"); + break; + case 0: + close(filedes[0]); + _genkey(pubkeyfile, kdap); + /* Write the new kdap back to the parent. */ + bytes = write(filedes[1], kdap, sizeof(*kdap)); + if (bytes != sizeof(*kdap)) + err(1, "genkey pipe write"); + _exit(0); + } + close(filedes[1]); + /* Read in the child's genkey() result into kdap. */ + bytes = read(filedes[0], kdap, sizeof(*kdap)); + if (bytes != sizeof(*kdap)) + errx(1, "genkey pipe read"); + error = waitpid(pid, &status, WEXITED); + if (error == -1) + err(1, "waitpid"); + if (WIFEXITED(status) && WEXITSTATUS(status) != 0) + errx(1, "genkey child exited with status %d", + WEXITSTATUS(status)); + else if (WIFSIGNALED(status)) + errx(1, "genkey child exited with signal %d", + WTERMSIG(status)); + close(filedes[0]); +} #endif static void
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202107262010.16QKAN02022928>