summaryrefslogtreecommitdiffstats
path: root/sys/kern/kern_unveil.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
* spellingjsg2021-03-101-3/+3
| | | | ok gnezdo@ semarie@ mpi@
* remove unused variable; ok beck@ mpi@anton2020-03-221-4/+2
|
* Separate variable declaration and assignment. No functional change.anton2020-03-191-2/+3
| | | | Requested by mpi@
* Move unveil data structures away from the proc.h header into theanton2020-03-191-1/+27
| | | | | | | implementation file. Pushing the assignment of ps_uvpcwd down to unveil_add() is required but it doesn't introduce any functional change. ok mpi@ semarie@
* delete wasteful ;;deraadt2020-01-221-2/+2
| | | | ok tedu
* Eliminate the sketchy use of ps_mainproc here by making unveil_add_vnode()guenther2019-11-291-41/+41
| | | | | | | take a struct proc* instead of a struct process*, and vice versa making unveil_lookup() take a process* instead of a proc*. ok beck@
* Only increment the ps_uvncount counter when a path is successfully addedanton2019-10-011-10/+18
| | | | | | | | | | to the corresponding red-black tree; meaning the path was not already present in the tree. This prevents an assertion to trigger in unveil_destroy() later on when the process exits. ok beck@ Reported-by: syzbot+db66362e1ffdc72e5aeb@syzkaller.appspotmail.com
* Fix unveil for relative lookups in the non AT_FDCWD casebeck2019-09-111-11/+39
| | | | | | | | | | | | | Issue spotted by Benjamin Baier <programmer@netzbasis.de> with relative path lookups from openat(2). Lacking a current working directory unveil, operations using the *at functions could fail when not crossing an unveil, since an initial covering unveil was not found. This corrects this so we walk up from the directory vnode to find a covering unveil at the start of non AT_FDCWD lookups, and adds regress for this case. ok bluhm@
* Remove the unused function parameter rootvnode from unveil_add_vnode().bluhm2019-08-051-5/+4
|
* Move prototypes of unveil(2) functions which are used in separate Cbluhm2019-08-021-4/+1
| | | | | files into the common namei.h header. OK deraadt@
* In ufs_lookup() *vpp is always refcounted, also in the ISDOTDOTbluhm2019-08-011-3/+2
| | | | | | | | case even if *vpp == vdp. So in unveil_find_cover() it is wrong to skip dereferencing if parent == vp. This fixes an umount(8) device busy error when unveil(2) and chroot(2) are used together on a file system. reported by Matthias Pitzl; OK deraadt@
* correct mispellings of EACCES; from Kris Katterjohnderaadt2019-07-291-2/+2
|
* Use process accounting to find programs which try to access filesbluhm2019-07-251-4/+10
| | | | | that are hidden by unveil(2). OK deraadt@
* Don't lock the struct unveil being created in the child when cloning theguenther2019-07-141-6/+12
| | | | | | | parent's during fork() witness reports from ajacoutot@ and Hrvoje Popovski (hrvoje (at) srce.hr) ok visa@
* the pledge STATLIE code is no longer needed, as discussed with beck.deraadt2019-06-191-2/+1
| | | | it actually isn't reached...
* Remove this assert, I can't do this here with UNVEIL_INSPECTbeck2019-03-261-2/+1
| | | | | | | added aggressively today. Hopefully post release a glorious flensing will remove UNVEIL_INSPECT anyway Reported-by: syzbot+3375ce307ac7909b907b@syzkaller.appspotmail.com
* Make stat(2) and access(2) need UNVEIL_READ instead of UNVEIL_INSPECTbeck2019-03-241-2/+7
| | | | | | | | | | | | | | | UNVEIL_INSPECT is a hack we added to get chrome/glib working. It silently adds permission for stat(2), access(2), and readlink(2) to be used on all path components of any unveil'ed path. robert@ has sucessfully now fixed chrome/glib to not require exessive TOC vs TOU stat(2) and access(2) calls on the paths it uses, so that this no longer needed there. readlink(2) is the sole call that is now permitted by UNVEIL_INSPECT, and this is only needed so that realpath(3) can work. Going forward we will likely make a realpath(2), after which we can completely deprecate UNVEIL_INSPECT. ok deraadt@
* sometimes we don't call unveil_add, which means memory allocated by nameitedu2019-01-211-3/+1
| | | | | | doesn't get freed. move the free calls into the same function as namei. fixed bug report from Dariusz Sendkowski ok beck
* Unveil fixes:beck2019-01-171-12/+39
| | | | | | | | | 1) Correctly notice covering unveil when using .. - fix crash noticed by visa@ 2) Notice when v_mount is NULL to not crash when unveil vnodes are on a forcibly unmounted filesystem, noticed by yasuoka@ 3) Add a flag to ni_data so that failures from unveil flag mismatches in covering unveils return the correct EACCESS instead of ENOENT (noticed by brynet@) ok deraadt@
* backout previous; crashes near mountpoints it seemsderaadt2019-01-141-7/+4
|
* Fix unveil issue noticed by kn@ where unveil does not notice coveringbeck2019-01-141-4/+7
| | | | | unveil matches when .. is used correctly. Also adds regress based upon his test program for the same issue.
* Clear ps_uvpcwd when we free ps_uvpaths. Fixes a crash seen by kn@ and mekettenis2019-01-061-1/+2
| | | | | | where ps_uvpcwd obviously contains a dangling pointer. ok deraadt@, krw@
* Fix a collection of covering unveil bugs that prevent unveil's of upperbeck2019-01-031-11/+26
| | | | | | level directories from working when you don't traverse into them starting from /. Most found by brynet@ and a few others. ok brynet@ deraadt@
* needs sys/lock.hderaadt2018-10-291-1/+2
|
* Correctly deal with upper level unveil's by keeping track of the coveringbeck2018-10-281-75/+230
| | | | | | | unveil for each unveil in the process at unveil() time, and refactoring the handling of current directory and ISDOTDOT to be much more sensible. Worked out at ns2k18 with guenther@. ok deraadt@
* fix typo in commentjasper2018-09-251-2/+2
| | | | ok beck@
* Fix stat of path components - this was breaking chrome - because thebeck2018-08-281-11/+9
| | | | | | final directory in a name unveil was not being added with UNVEIL_INSPECT if it was not already unveiled. Now passes just added regress test for this case
* Get rid of PLEDGE_STAT, which was a hack used for unveil.beck2018-08-111-20/+17
| | | | | | | | We use UNVEIL_INSPECT instead in the unveil flags for the same purpose, and now add traversed vnodes of a path with UNVEIL_INSPECT instead of with 0 flags and voodoo in unveil_flagmatch. This allows us to uncontort the logic of unveil_flagmatch a bunch. helpful review and ok from semarie@
* UNVEIL_* flags defined elsewhere in a .h filederaadt2018-08-071-6/+1
|
* Decouple unveil from the pledge flags, by adding dedicated unveil flagsbeck2018-08-051-23/+29
| | | | | | | | to the namei args. This fixes a bug where chmod would be allowed when with only READ. This also allows some further cleanup of some awkward things like PLEDGE_STAT that will follow Lots of assistence from semarie@ - thanks! ok semarie@
* Prevent a panic when reboot -q is used by making unveil_removevnodebeck2018-08-051-9/+18
| | | | | sane. ok kettenis@
* rename 2nd argument of unveil from vague "flags" to "permissions";deraadt2018-07-301-10/+10
| | | | man page change will follow
* KNFderaadt2018-07-301-14/+16
|
* revert accidentally changed prototypebeck2018-07-291-2/+2
|
* Don't exceed UNVEIL_MAX_VNODES with a long path now that we savebeck2018-07-291-3/+6
| | | | the traversed vnodes - noticed and fixed by semarie@
* Make sure we don't count looking at .. as a componentbeck2018-07-291-1/+2
| | | | | as a descending match. Noticed by Stuart Cassoff <3d0g@bell.net>
* Correctly copy across unveil's from parent to child process on fork().beck2018-07-201-24/+36
|
* unvname_new() is passed something that is always 64-bits so thekrw2018-07-171-2/+2
| | | | | | | parameter should be declared uint64_t and not int. From & for semarie@ who isn't committing at the moment and ok beck@ who is on the road.
* unbreak gcc4 buildjsg2018-07-131-2/+1
|
* Unveiling unveil(2).beck2018-07-131-0/+727
This brings unveil into the tree, disabled by default - Currently this will return EPERM on all attempts to use it until we are fully certain it is ready for people to start using, but this now allows for others to do more tweaking and experimentation. Still needs to send the unveil's across forks and execs before fully enabling. Many thanks to robert@ and deraadt@ for extensive testing. ok deraadt@
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.