diff options
| author |   natano <natano@openbsd.org> | 2016-10-06 21:00:00 +0000 |
|---|---|---|
| committer | natano <natano@openbsd.org> | 2016-10-06 21:00:00 +0000 |
| commit | 465f44c2bfe090b8432796fc5bcd63b1d055d351 (patch) | |
| tree | dc549a6d3823c0e8070576056de6fb9aac4759e2 | |
| parent | Enable pledge(2) in vmm and the VM processes: This way the VMs and (diff) | |
| download | wireguard-openbsd-465f44c2bfe090b8432796fc5bcd63b1d055d351.tar.xz wireguard-openbsd-465f44c2bfe090b8432796fc5bcd63b1d055d351.zip | |
On noperm mount points honor the permissions of the root directory, so
access can be locked down.
ok deraadt tb
| -rw-r--r-- | sbin/mount/mount.8 | 4 | ||||
| -rw-r--r-- | sys/ufs/ufs/ufs_vnops.c | 5 |
2 files changed, 6 insertions, 3 deletions
diff --git a/sbin/mount/mount.8 b/sbin/mount/mount.8 index 7a5109d2723..79fcff36172 100644 --- a/sbin/mount/mount.8 +++ b/sbin/mount/mount.8 @@ -1,4 +1,4 @@ -.\" $OpenBSD: mount.8,v 1.87 2016/10/06 11:43:30 schwarze Exp $ +.\" $OpenBSD: mount.8,v 1.88 2016/10/06 21:00:00 natano Exp $ .\" $NetBSD: mount.8,v 1.11 1995/07/12 06:23:21 cgd Exp $ .\" .\" Copyright (c) 1980, 1989, 1991, 1993 @@ -204,6 +204,8 @@ directories in the mounted file system. This allows unprivileged users to construct a file hierarchy containing special device nodes and files with arbitrary file mode, owner or group without restriction. +Only the owner, group and mode of the root directory of the filesystem +will be honored so access to the filesystem can be locked down. The noperm option also enables the nodev and noexec options to ensure that interpretation of the file modes and special devices cannot be used to gain privileges. diff --git a/sys/ufs/ufs/ufs_vnops.c b/sys/ufs/ufs/ufs_vnops.c index e557278abc7..341ffabeb09 100644 --- a/sys/ufs/ufs/ufs_vnops.c +++ b/sys/ufs/ufs/ufs_vnops.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ufs_vnops.c,v 1.131 2016/09/10 16:53:30 natano Exp $ */ +/* $OpenBSD: ufs_vnops.c,v 1.132 2016/10/06 21:00:00 natano Exp $ */ /* $NetBSD: ufs_vnops.c,v 1.18 1996/05/11 18:28:04 mycroft Exp $ */ /* @@ -274,7 +274,8 @@ ufs_access(void *v) if ((mode & VWRITE) && (DIP(ip, flags) & IMMUTABLE)) return (EPERM); - if (vp->v_mount->mnt_flag & MNT_NOPERM) + if (vp->v_mount->mnt_flag & MNT_NOPERM && + (vp->v_flag & VROOT) == 0) return (0); return (vaccess(vp->v_type, DIP(ip, mode), DIP(ip, uid), DIP(ip, gid), |