summaryrefslogtreecommitdiffstats
path: root/sys/kern/kern_tame.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Rename tame() to pledge(). This fairly interface has evolved to be morederaadt2015-10-091-1241/+0
| | | | | | strict than anticipated. It allows a programmer to pledge/promise/covenant that their program will operate within an easily defined subset of the Unix environment, or it pays the price.
* Rename tame() to pledge(). This fairly interface has evolved to be morederaadt2015-10-091-328/+328
| | | | | | strict than anticipated. It allows a programmer to pledge/promise/covenant that their program will operate within an easily defined subset of the Unix environment, or it pays the price.
* Expose a small set of multicast join operators under the request "mcast".deraadt2015-10-081-2/+18
| | | | | | This will be used by a few daemons. If they lack this feature, then they would need to operate without tame. Discussed with renato
* setsockopt has a small list of options it can set. If we find ourselvesderaadt2015-10-081-1/+8
| | | | | only in TAME_UNIX, stop trying after servicing SOL_SOCKET. discussion with claudio
* Only in TAME_ROUTE, allow ioctl SIOCGIFADDR/SIOCGIFFLAGS/SIOCGIFRDOMAIN,deraadt2015-10-081-1/+12
| | | | | | because many routing daemon processes with this attribute need to fetch that information to work. discussed with claudio and renato
* Split out routing sysctl's from tame "inet", and put them into thederaadt2015-10-071-44/+55
| | | | | | | | new tame "route" request. Now routing daemons and tools (such as arp), can narrowly ask for either feature. One thing remains available in both cases -- support for getifaddr()'s, since libc and programs often use that in close association with socket creation. ok benno sthen beck, some discussion with renato
* Add the tame "exec" request. This allows processes which requestderaadt2015-10-071-1/+18
| | | | | | | | | | | | | | | "exec" to call execve(2), potentially fork(2) beforehands if they asked for "proc". Calling execve is what "shells" (ksh, tmux, etc) have as their primary purpose. But meantime, if such a shell has a nasty bug, we want to mitigate the process from opening a socket or calling 100+ other system calls. Unfortunately silver bullets are in short supply, so if our goal is to stay in a POSIX-y environment, we have to let shells call execve(). POSIX ate the world, so choices do we all have? Warning for many: silver bullets are even more rare in other OS ecosystems, so please accept this as a narrow lowering of the bar in a very raised environment. Commited from a machine running tame "proc exec" ksh, make, etc.
* A process should be able to do sigpending for itselfderaadt2015-10-061-1/+2
|
* For TAME_PROC, allow setrlimit()deraadt2015-10-061-1/+2
|
* When "proc" is requested, allow setpgid() and sigsuspend().deraadt2015-10-061-1/+7
| | | | | | | Also the combination of "proc tty" needs to permit TIOCSPGRP. This is the start at minimum semantics required by processes which work on process groups, sessions, ttys.
* Add new "tty" request, which allows TIOCGETA, TIOCGPGRP, TIOCGWINSZ,deraadt2015-10-061-22/+36
| | | | | | | | | | | | | | | | TIOCSBRK, TIOCCDTR, TIOCSETA, TIOCSETAW, and TIOCSETAF on tty vnodes. This helps programs which call tcsetattr(), tcgetattr(), or readpassphrase(). Especially the latter - tame's goal is to satisfy the libc requirements of security-sensitive programs. Remove TIOCSETAF from the basic "ioctl" request, because it is a "set" option. "ioctl" is slowly turning into a "request information, cannot set options" package. Split the "cmsg" request into "sendfd" and "recvfd". Non-SCM_RIGHTS messages are currently flowing through freely and we'll need to think about that. This split lets us more strictly describe what our many fd-passing programs will do.
* Rework the tame cmsg handler to make it work both ways. While on recv oneclaudio2015-10-061-19/+10
| | | | | | mbuf blob with all the cmsgs inside while on send cmsgs in an mbuf chain, one mbuf per message. Adjust the calls accordingly. Putting it in so deraadt@ can move forward.
* oops, namei was never allowing through valid CPATH operationsderaadt2015-10-061-2/+3
|
* Add getrusage() to the TAME_SELF catagory.deraadt2015-10-061-1/+2
|
* Enable ioctl() in the "rw" request, to support FIONREAD/FIONBIO easierderaadt2015-10-061-60/+48
| | | | | | for the stdio/libevent usage case. Further ioctl commands are narrowly checked as before. ok djm guenther semarie
* Move getcwd to a seperate area, with a hand-waving explanation for whyderaadt2015-10-041-2/+7
| | | | it is RPATH|WPATH... nothing changes, just the new explanation.
* Allow sysctl read of vm.vm_psstrings, as setproctitle() uses this toderaadt2015-10-041-1/+7
| | | | | find the ps buffer. Few programs want to do their first setproctitle() rather late...
* spellingderaadt2015-10-041-2/+2
|
* Add ktracing of tame()'s arguments' valuesguenther2015-10-031-1/+9
| | | | "every tool helps" deraadt@
* I see no evidence that lstat() is being done for /etc/resolv.conf, norderaadt2015-10-021-2/+2
| | | | can I figure out why I added this in the past...
* kern_tame.cderaadt2015-10-021-2/+3
|
* Actually, open of /etc/spwd.db must be handled by returning EPERM, notderaadt2015-10-021-1/+3
| | | | | | dropping through to to the kill path. The best way to understand this is id(1). It calls getpwuid, which tries /etc/spwd.db before /etc/pwd.db ...
* mention these pathname calls are checked in nameideraadt2015-10-021-5/+5
|
* remove some debug printf no longer neededderaadt2015-10-021-15/+4
|
* changed my mind; block spwd.db, force drop-through to pwd.db for processes under tamederaadt2015-10-021-3/+1
|
* Fix tame(2) setsockopt check for TCP level.doug2015-10-011-1/+3
| | | | ok deraadt@, semarie@
* add IPv6 equivalents for the permitted IPv4 setsockopts, noticed by doug@,sthen2015-10-011-1/+9
| | | | ok semarie@
* implement new "prot_exec" tame(2) request:semarie2015-09-301-2/+3
| | | | | | | | | | | - by default, a tamed-program don't have the possibility to use PROT_EXEC for mmap(2) or mprotect(2) - for that, use the request "prot_exec" (that could be dropped later) initial idea from deraadt@ and kettenis@ "make complete sense" beck@ ok deraadt@
* Reluctantly classify statfs and fstatfs as RPATH for now, because theyderaadt2015-09-291-3/+4
| | | | leak system path information. Should be reconsidered in the future.
* make using tame path "/" work.semarie2015-09-281-2/+3
| | | | | | and add a regress test for that. ok deraadt@
* In the internal conversion of _TM_* to TAME_*, some bits were lost forsemarie2015-09-191-3/+3
| | | | | | | | "dns" and "cmsg" in the `tamereq' array. Restore the previous behaviour. ok guenther@
* Rename __sysctl syscall to just sysctl, as the userland wrapper is no longerguenther2015-09-131-2/+2
| | | | | | necessary ok deraadt@ jsing@
* Convert _TM_ flags to TAME_ flags, collapsing the entire mappingderaadt2015-09-111-200/+200
| | | | | | layer because the strings select the right options. Mechanical conversion. ok guenther
* Only include <sys/tame.h> in the .c files that need itguenther2015-09-111-1/+2
| | | | ok deraadt@ miod@
* Move to next tame() API. The flags are now passed as a very simple string,deraadt2015-09-091-3/+63
| | | | | | | | which results in tame() code placements being much more recognizeable. tame() can be moved to unistd.h and does not need cpp symbols to turn the bits on and off. The resulting API is a bit unexpected, but simplifies the mapping to enabling bits in the kernel substantially. vague ok's from various including guenther doug semarie
* the special check logic for /usr/share/nls/../libc.cat became failurederaadt2015-09-011-3/+3
| | | | | | to return failure. open() of these paths should succeed to satisfy strerror() and friends. ok semarie
* Corrects a use-after-free in tame_namei().semarie2015-09-011-2/+2
| | | | ok doug@
* Consider getfsstat() a RPATH, even though it has no path in it. We mayderaadt2015-08-311-1/+5
| | | | | | want to do the same for fstatfs(), after we handle statfs(). These system calls leak path information, however I am reluctant to add a seperate catagory.
* spaces snuck inderaadt2015-08-311-13/+12
|
* use ENAMETOOLONG instead of EINVAL for errno when string overflow occurs.semarie2015-08-261-3/+3
| | | | | | document tame.2 according. ok deraadt@
* After a report from jsg about a memory leak (or was it a double free?),deraadt2015-08-261-38/+26
| | | | | refactor the code around getcwd and canonpath, with some help from semarie ok semarie
* Add TIOCGETA to the tame list for TAME_IOCTL.doug2015-08-261-1/+2
| | | | | | This is used by readpassphrase() and curses. ok deraadt@
* Convert paths argument of tame(2) to const char **.doug2015-08-261-3/+3
| | | | | | The path will not be modified and this reduces casts. Discussed with many. ok deraadt@
* remove duplicate SYS_utimes entryjsg2015-08-251-2/+1
| | | | ok deraadt@
* corrects two potential double-free on `cwdpath'. The variable will be free'edsemarie2015-08-241-3/+1
| | | | | | outside the for-loop. OK deraadt@
* Initialize cwdpath so free() is properly handled.doug2015-08-241-2/+2
| | | | ok deraadt@
* fix /tmp handling of unlink(); from Caspar Schutijserderaadt2015-08-231-2/+2
|
* Perform maximum one cwd lookup in tame(), also make namei version look thederaadt2015-08-231-36/+47
| | | | | same. Idea from semarie
* Canonicalize non-rooted paths after cwd prepend.deraadt2015-08-231-30/+51
| | | | with semarie
* check correct offset for terminator; with semariederaadt2015-08-231-2/+2
|
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.