From owner-freebsd-bugs@FreeBSD.ORG Sat Sep 6 10:28:15 2003 Return-Path: Delivered-To: freebsd-bugs@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id F164E16A4BF; Sat, 6 Sep 2003 10:28:15 -0700 (PDT) Received: from cs.columbia.edu (cs.columbia.edu [128.59.16.20]) by mx1.FreeBSD.org (Postfix) with ESMTP id 014CC4400B; Sat, 6 Sep 2003 10:28:15 -0700 (PDT) (envelope-from lennox@cs.columbia.edu) Received: from cnr.cs.columbia.edu (cnr.cs.columbia.edu [128.59.19.133]) by cs.columbia.edu (8.12.9/8.12.9) with ESMTP id h86HSDaH016963 (version=TLSv1/SSLv3 cipher=EDH-RSA-DES-CBC3-SHA bits=168 verify=NOT); Sat, 6 Sep 2003 13:28:14 -0400 (EDT) Received: from cnr.cs.columbia.edu (localhost [127.0.0.1]) by cnr.cs.columbia.edu (8.12.9/8.12.9) with ESMTP id h86HSDYj089390; Sat, 6 Sep 2003 13:28:13 -0400 (EDT) (envelope-from lennox@cnr.cs.columbia.edu) Received: (from lennox@localhost) by cnr.cs.columbia.edu (8.12.9/8.12.9/Submit) id h86HSD6T089387; Sat, 6 Sep 2003 13:28:13 -0400 (EDT) From: Jonathan Lennox MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <16218.6445.294271.622770@cnr.cs.columbia.edu> Date: Sat, 6 Sep 2003 13:28:13 -0400 To: FreeBSD-gnats-submit@FreeBSD.org, freebsd-bugs@FreeBSD.org In-Reply-To: <200309051730.h85HUDxE019269@freefall.freebsd.org> References: <200309051722.h85HMPbj085465@cnr.cs.columbia.edu> <200309051730.h85HUDxE019269@freefall.freebsd.org> X-Mailer: VM 7.17 under Emacs 20.7.1 Subject: Re: bin/56500: rpc.lockd needs to use reserved ports X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 06 Sep 2003 17:28:16 -0000 After a day or so of untangling how RPC code works, I've worked out a patch. I'm pretty sure that this patch regains root privileges for the absolute minimum amount of time necessary to bind to a reserved port. I've tested this, and it does (along with the patch in kern/56461) allow me to sucessfully lock files from a Linux server -- and thus to invoke movemail on my mailspool, and thus to read my mail on my FreeBSD machine, which was the whole motivation. --- usr.sbin/rpc.lockd/lock_proc.c.orig Sat Sep 6 12:48:10 2003 +++ usr.sbin/rpc.lockd/lock_proc.c Sat Sep 6 13:18:08 2003 @@ -197,6 +197,8 @@ const char *netid; struct netconfig *nconf; char host[NI_MAXHOST]; + uid_t old_euid; + int clnt_fd; gettimeofday(&time_now, NULL); @@ -270,6 +272,22 @@ syslog(LOG_ERR, "Unable to return result to %s", host); return NULL; } + + /* Get the FD of the client, for bindresvport. */ + clnt_control(client, CLGET_FD, &clnt_fd); + + /* Regain root privileges, for bindresvport. */ + old_euid = geteuid(); + seteuid(0); + + /* + * Bind the client FD to a reserved port. + * Some NFS servers reject any NLM request from a non-reserved port. + */ + bindresvport(clnt_fd, NULL); + + /* Drop root privileges again. */ + seteuid(old_euid); /* Success - update the cache entry */ clnt_cache_ptr[clnt_cache_next_to_use] = client;