From owner-svn-src-all@FreeBSD.ORG  Thu Mar 14 23:14:48 2013
Return-Path: <owner-svn-src-all@FreeBSD.ORG>
Delivered-To: svn-src-all@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 by hub.freebsd.org (Postfix) with ESMTP id 1B81B46F;
 Thu, 14 Mar 2013 23:14:48 +0000 (UTC) (envelope-from pjd@FreeBSD.org)
Received: from svn.freebsd.org (svn.freebsd.org
 [IPv6:2001:1900:2254:2068::e6a:0])
 by mx1.freebsd.org (Postfix) with ESMTP id F3144166;
 Thu, 14 Mar 2013 23:14:47 +0000 (UTC)
Received: from svn.freebsd.org ([127.0.1.70])
 by svn.freebsd.org (8.14.6/8.14.6) with ESMTP id r2ENElxw059891;
 Thu, 14 Mar 2013 23:14:47 GMT (envelope-from pjd@svn.freebsd.org)
Received: (from pjd@localhost)
 by svn.freebsd.org (8.14.6/8.14.5/Submit) id r2ENElAc059890;
 Thu, 14 Mar 2013 23:14:47 GMT (envelope-from pjd@svn.freebsd.org)
Message-Id: <201303142314.r2ENElAc059890@svn.freebsd.org>
From: Pawel Jakub Dawidek <pjd@FreeBSD.org>
Date: Thu, 14 Mar 2013 23:14:47 +0000 (UTC)
To: src-committers@freebsd.org, svn-src-all@freebsd.org,
 svn-src-head@freebsd.org
Subject: svn commit: r248297 - head/sbin/hastd
X-SVN-Group: head
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-BeenThere: svn-src-all@freebsd.org
X-Mailman-Version: 2.1.14
Precedence: list
List-Id: "SVN commit messages for the entire src tree \(except for &quot;
 user&quot; and &quot; projects&quot; \)" <svn-src-all.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/svn-src-all>,
 <mailto:svn-src-all-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/svn-src-all>
List-Post: <mailto:svn-src-all@freebsd.org>
List-Help: <mailto:svn-src-all-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/svn-src-all>,
 <mailto:svn-src-all-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 14 Mar 2013 23:14:48 -0000

Author: pjd
Date: Thu Mar 14 23:14:47 2013
New Revision: 248297
URL: http://svnweb.freebsd.org/changeset/base/248297

Log:
  Now that ioctl(2) is allowed in capability mode and we can limit ioctls for the
  given descriptors, use Capsicum sandboxing for hastd in primary and secondary
  modes. Allow for DIOCGDELETE and DIOCGFLUSH ioctls on provider descriptor and
  for G_GATE_CMD_MODIFY, G_GATE_CMD_START, G_GATE_CMD_DONE and G_GATE_CMD_DESTROY
  on GEOM Gate descriptor.
  
  Sponsored by:	The FreeBSD Foundation

Modified:
  head/sbin/hastd/subr.c

Modified: head/sbin/hastd/subr.c
==============================================================================
--- head/sbin/hastd/subr.c	Thu Mar 14 23:11:52 2013	(r248296)
+++ head/sbin/hastd/subr.c	Thu Mar 14 23:14:47 2013	(r248297)
@@ -31,14 +31,15 @@
 #include <sys/cdefs.h>
 __FBSDID("$FreeBSD$");
 
-#ifdef HAVE_CAPSICUM
-#include <sys/capability.h>
-#endif
 #include <sys/param.h>
 #include <sys/disk.h>
 #include <sys/ioctl.h>
 #include <sys/jail.h>
 #include <sys/stat.h>
+#ifdef HAVE_CAPSICUM
+#include <sys/capability.h>
+#include <geom/gate/g_gate.h>
+#endif
 
 #include <errno.h>
 #include <fcntl.h>
@@ -224,22 +225,53 @@ drop_privs(const struct hast_resource *r
 		return (-1);
 	}
 
-	/*
-	 * Until capsicum doesn't allow ioctl(2) we cannot use it to sandbox
-	 * primary and secondary worker processes, as primary uses GGATE
-	 * ioctls and secondary uses ioctls to handle BIO_DELETE and BIO_FLUSH.
-	 * For now capsicum is only used to sandbox hastctl.
-	 */
 #ifdef HAVE_CAPSICUM
-	if (res == NULL) {
-		capsicum = (cap_enter() == 0);
-		if (!capsicum) {
-			pjdlog_common(LOG_DEBUG, 1, errno,
-			    "Unable to sandbox using capsicum");
+	capsicum = (cap_enter() == 0);
+	if (!capsicum) {
+		pjdlog_common(LOG_DEBUG, 1, errno,
+		    "Unable to sandbox using capsicum");
+	} else if (res != NULL) {
+		static const unsigned long geomcmds[] = {
+		    DIOCGDELETE,
+		    DIOCGFLUSH
+		};
+
+		PJDLOG_ASSERT(res->hr_role == HAST_ROLE_PRIMARY ||
+		    res->hr_role == HAST_ROLE_SECONDARY);
+
+		if (cap_rights_limit(res->hr_localfd,
+		    CAP_FLOCK | CAP_IOCTL | CAP_PREAD | CAP_PWRITE) == -1) {
+			pjdlog_errno(LOG_ERR,
+			    "Unable to limit capability rights on local descriptor");
+		}
+		if (cap_ioctls_limit(res->hr_localfd, geomcmds,
+		    sizeof(geomcmds) / sizeof(geomcmds[0])) == -1) {
+			pjdlog_errno(LOG_ERR,
+			    "Unable to limit allowed GEOM ioctls");
+		}
+
+		if (res->hr_role == HAST_ROLE_PRIMARY) {
+			static const unsigned long ggatecmds[] = {
+			    G_GATE_CMD_MODIFY,
+			    G_GATE_CMD_START,
+			    G_GATE_CMD_DONE,
+			    G_GATE_CMD_DESTROY
+			};
+
+			if (cap_rights_limit(res->hr_ggatefd, CAP_IOCTL) == -1) {
+				pjdlog_errno(LOG_ERR,
+				    "Unable to limit capability rights to CAP_IOCTL on ggate descriptor");
+			}
+			if (cap_ioctls_limit(res->hr_ggatefd, ggatecmds,
+			    sizeof(ggatecmds) / sizeof(ggatecmds[0])) == -1) {
+				pjdlog_errno(LOG_ERR,
+				    "Unable to limit allowed ggate ioctls");
+			}
 		}
-	} else
+	}
+#else
+	capsicum = false;
 #endif
-		capsicum = false;
 
 	/*
 	 * Better be sure that everything succeeded.