summaryrefslogtreecommitdiffstats
path: root/usr.bin (follow)
Commit message (Collapse)AuthorAgeFilesLines
...
* Add tame(2) to file(1) and drop the old systrace(4) sandbox. tame(2) isnicm2015-10-043-168/+44
| | | | | | | | only applied to the child process, which requires the parent to not pass directory file descriptors (tame("cmsg") does not allow it). Because file(1) is already privsep, the permissions in the child can be quickly restricted: first to "stdio cmsg getpw proc" then after the privdrop to "stdio cmsg".
* Repair tame() error check to be == -1deraadt2015-10-042-4/+4
|
* Add ktracing of tame()'s arguments' valuesguenther2015-10-034-26/+30
| | | | "every tool helps" deraadt@
* option LFS is dead, but we missed option ACCOUNTING hereguenther2015-10-031-3/+3
|
* you can't edit stdin in place. check for this before the hack thattedu2015-10-031-1/+3
| | | | | increments argc when run with no arguments, causing a read past the end of argv.
* Now that dc(1) no longer supports !command with popen(), we can startderaadt2015-10-031-1/+7
| | | | | off with tame "stdio rpath". Once the (optional) file is opened, a further drop down to tame "stdio" works.
* delete documentation for ! commandderaadt2015-10-031-6/+2
|
* disable ! command, makes dc(1) more tameableotto2015-10-031-10/+2
|
* wc only opens files read-only, proceses them, and spits results to stdout.deraadt2015-10-031-1/+4
| | | | tame "stdio rpath" works, right before calling getopt()
* As pointed out by tobiasu, ed-style patches still use popen() and executederaadt2015-10-031-2/+2
| | | | | | | | | /bin/ed. This is RETARDED. Nothing learned from the last year? Add tame "proc" until that is fixed, to allow fork+exec. I beg for someone to cross-link the guts of ed directly into patch, or write a ed-subset which can do the job.
* - Simplify use of ctype functions.tim2015-10-031-16/+8
| | | | | | | - Replace arc4random with arc4random_uniform. - Replace memset with explicit_bzero. OK millert@
* tame "stdio" right between setlocale and getopt, it is easy to reviewderaadt2015-10-031-1/+4
| | | | | | this program and see it does uname(3) and stdio printf. uname(3) is backed by a cluster of sysctl() reads, all permitted by the kernel in tame_sysctl_check()
* Fix wrong cast.zhuk2015-10-031-2/+2
| | | | | | | | This one should be an unsigned long in theory, but the formatter function argument we're printing from is already an int (being casted from register_t at the formatter call time). So lets fix one bug at a time. authoritative okay from guenther@
* grep only opens files read-only, reads via stdio or other methods, performsderaadt2015-10-031-1/+4
| | | | | | | | | | | | | | | computation, and outputs result to stdout. (note: in the tame model, malloc is implicit because stdio needs it, and mmap is implicit since malloc needs it; libz is satisfied by this environment also). this tame change consists of 1 line, setting "stdio rpath" before getopt. this protection is fairly strict. grep could be improved further by computing a wpathlist based on argv, keeping -R in mind. feel free to take a shot at it. grep was an early target of capsicum also. know anyone running capsicum grep? ok doug
* tame "stdio getpw rpath" can be done quite early after the getopt.deraadt2015-10-031-1/+4
| | | | | | it might seem we can hoist the open above tame and then drop "rpath", but guenther found getprotobynumber can be called much later. ok guenther
* leave does a fork, but other than that it is boring stdio.deraadt2015-10-031-2/+5
| | | | | tame "stdio proc" satisfies it. ok doug
* gzip can use tame "stdio wpath cpath fattr". this blocks a lot ofderaadt2015-10-031-1/+4
| | | | | | | | | | | | system behaviours such as forking, execve, sockets, etc. in theory this extended by parsing the arguments first, and creating the whitepathlist. the pathlist probably needs to be directory-oriented, rather than exact path of files, because a gzip file may specify the filename it wants (and that won't be available until it is opened, and partially parsed). anyone want to give this a try? gzip was an early goal for capsicum. who is running a capsicum gzip?
* BIO_get_fd() could return fd 0; fix error condition. Found atderaadt2015-10-031-2/+2
| | | | | http://marc.info/?l=openssl-dev&m=144374015404899&w=2 ok doug
* switch from using the systrace-based sandbox to the tame-based sandbox.deraadt2015-10-031-2/+2
| | | | | discussed it at length with djm -- i think it is time to give this a trial in snapshots.
* patch appears to work fully with tame "stdio rpath wpath cpath tmppath fattr".deraadt2015-10-031-1/+4
| | | | | | in case of exploitation, no more network access, fork, execve, etc. I wonder if we could use whitepath lists here - if it is reasonable to limit operation in directories known early on?
* uniq has a complicated initialization around getopt. beforehands, wederaadt2015-10-031-1/+7
| | | | | | | can tame "stdio rpath wpath cpath"; all three paths abilities are needed for it to setup the right files (worst case spotted by sthen). later once the files are opened, the program is only looking at strings and outputing via stdio functions, so we can tame "stdio".
* script is two processes. the main io-loop process can be locked down withderaadt2015-10-031-1/+7
| | | | | | | tame "stdio" since all it does is move data back and forth, while the master process needs "stdio ioctl" to use TCSAFLUSH at the very end. TCSAFLUSH is included in the kernel's rather restrictive ioctl feature lists made available with the "ioctl" ability.
* finger can either do local users only, or in in remote users. (whoderaadt2015-10-031-1/+10
| | | | | | still runs fingerd? not many places, it took a while to find a server) tame "stdio getpw rpath inet" is possible early on, then later when the network lookups list is consumed, tame "stddio getpw rpath"
* whois uses dns to lookup whois servers, and then opens sockets to them.deraadt2015-10-031-1/+4
| | | | | it does not need to open any files, so we can tame with "stdio dns inet". i think florian and i did this about 2 months ago.
* even before it reaches getopt(), this program will never do more thanderaadt2015-10-031-1/+4
| | | | | talk to stdio. tame "stdio" is a no-brainer. reviewed a while ago by doug
* sed only works on files, so the obvious goal is to remove it's networkderaadt2015-10-031-1/+9
| | | | | | | access in case it is exploited. tame with "stdio wpath rpath cpath" seesms to covers all usage cases, except -i performs a fchmod() on the in-place file, so conditionally also needs "fattr". ok sthen
* update the -t args list; ok guentherjmc2015-10-022-5/+5
|
* use limits.h instead of sys/param.h to get PATH_MAXderaadt2015-10-022-3/+3
|
* avoid sys/param.h, by using PATH_MAXderaadt2015-10-021-1/+1
|
* fix emailderaadt2015-10-021-2/+2
|
* Replace %s in the format string, with its value (macro).ratchov2015-10-021-2/+2
|
* As the socket path is known, use its size rather that PATH_MAX.ratchov2015-10-021-5/+5
|
* use macros instead of hard-coded strings for unix sockets pathsratchov2015-10-021-4/+4
|
* Add ktracing of argv and envp to execve(2), with envp not traced by defaultguenther2015-10-025-48/+111
| | | | ok tedu@ deraadt@
* a sandbox using tamederaadt2015-10-021-0/+71
| | | | ok djm
* re-order system calls in order of risk, ok i'll be honest, ordered thisderaadt2015-10-021-12/+19
| | | | | way they look like tame... ok djm
* update currency exchange rates;jmc2015-10-011-38/+38
|
* Another s/M_ASN1_INTEGER_free/ASN1_INTEGER_free/.jsing2015-10-011-2/+2
| | | | Found the hard way by Mark Patruck.
* Check to see if the file to be opened is a directory as soon as islum2015-09-291-5/+27
| | | | | | | feasible. Currently, mg does this check much later on which means some functions (e.g showbuffer()) are called multiple times. This fixes the location of the cursor when opening a directory using filevisit, findvisitalt and poptofile. ok jasper@
* rename random.c to util.c so it doesn't look scary. (util.c repo copied)tedu2015-09-292-513/+3
| | | | ok deraadt guenther
* Delete the final, inscrutable NOSTRICT and VARARGS lint commentsguenther2015-09-294-9/+4
| | | | ok millert@
* Mark eread(), veread(), and eformat() as printf-like andguenther2015-09-295-14/+13
| | | | | | Convert eread(buf, a2, a3, a4) to eread("%s", a2, a3, a4, buf) ok millert@ lum@
* Make dired mode treat a double '/' in a path like fundamental mode.lum2015-09-281-2/+2
| | | | Problem reported by jasper@ and ok jasper@
* Mark diag() as printf-likeguenther2015-09-272-5/+4
| | | | ok millert@
* Mark all the error printing functions as printf-like; fix two formatguenther2015-09-273-18/+18
| | | | | | mismatches this revealed ok espie@
* lint is dead: delete the trivial uses of /* VARARGS[0-9]+ */guenther2015-09-271-2/+1
| | | | (others require more care)
* whitespacejasper2015-09-268-53/+52
|
* tweak previous;jmc2015-09-261-3/+4
|
* Add transpose-paragraphs. ok jasper@lum2015-09-264-5/+53
|
* briefly document -T tree outputschwarze2015-09-261-2/+42
|
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.