From owner-freebsd-security@FreeBSD.ORG  Mon Mar  8 01:36:43 2004
Return-Path: <owner-freebsd-security@FreeBSD.ORG>
Delivered-To: freebsd-security@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 3F34416A4CE
	for <freebsd-security@freebsd.org>;
	Mon,  8 Mar 2004 01:36:43 -0800 (PST)
Received: from darkness.comp.waw.pl (unknown [195.117.238.236])
	by mx1.FreeBSD.org (Postfix) with ESMTP id EC52A43D3F
	for <freebsd-security@freebsd.org>;
	Mon,  8 Mar 2004 01:36:42 -0800 (PST)
	(envelope-from pjd@darkness.comp.waw.pl)
Received: by darkness.comp.waw.pl (Postfix, from userid 1009)
	id 3332DACADB; Mon,  8 Mar 2004 10:36:42 +0100 (CET)
Date: Mon, 8 Mar 2004 10:36:42 +0100
From: Pawel Jakub Dawidek <pjd@FreeBSD.org>
To: freebsd-security@freebsd.org
Message-ID: <20040308093642.GI10864@darkness.comp.waw.pl>
Mime-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha1;
	protocol="application/pgp-signature"; boundary="BVXm2WAry1WzRMtx"
Content-Disposition: inline
User-Agent: Mutt/1.4.2i
X-PGP-Key-URL: http://people.freebsd.org/~pjd/pjd.asc
X-OS: FreeBSD 5.2.1-RC2 i386
Subject: Call for review: restricted hardlinks.
X-BeenThere: freebsd-security@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Security issues [members-only posting]
	<freebsd-security.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>,
	<mailto:freebsd-security-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-security>
List-Post: <mailto:freebsd-security@freebsd.org>
List-Help: <mailto:freebsd-security-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>,
	<mailto:freebsd-security-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Mon, 08 Mar 2004 09:36:43 -0000


--BVXm2WAry1WzRMtx
Content-Type: text/plain; charset=iso-8859-2
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Hi.

I've no response from so@ in this topic, probably because leak of time,
so I'll try here.

Here is a patch that I'm planing to commit:

	http://people.freebsd.org/~pjd/patches/restricted_hardlinks.patch

It adds two new sysctls:

	security.bsd.hardlink_check_uid
	security.bsd.hardlink_check_gid

If sysctl security.bsd.hardlink_check_uid is set to 1, unprivileged users
are not permitted to create hard links to files not owned by them.
If sysctl security.bsd.hardlink_check_gid is set to 1, unprivileged users
are not permitted to create hard links to files if they are not member
of file's group.

For now user is able to create hardlinks to any files.

--=20
Pawel Jakub Dawidek                       http://www.FreeBSD.org
pjd@FreeBSD.org                           http://garage.freebsd.pl
FreeBSD committer                         Am I Evil? Yes, I Am!

--BVXm2WAry1WzRMtx
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (FreeBSD)

iD8DBQFATD6qForvXbEpPzQRAiTaAKCfMXA2A16hSpkekHEVorj7V+p7GACeMUyt
KwUJryIp77pUS/B87rmDEwA=
=vl8P
-----END PGP SIGNATURE-----

--BVXm2WAry1WzRMtx--