From nobody Sun May 12 00:08:31 2024 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4VcNJ02Y3kz5Jb9c; Sun, 12 May 2024 00:08:32 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4VcNHz6mmQz4syT; Sun, 12 May 2024 00:08:31 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1715472511; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=bzdgC4Lk2o0zgI9wkhVmjtW/Awwx6q+9hBDuwZx56lI=; b=H+eGCpO1iNFQj7ecSp6gwp/I30Cp8owoO6R2AysSjXTKfEz7qq4HYc7Ep1OJoHArzL7E1E a7mxO1a1TitXOBn3RhTGHqV+HK3llhetlruOEO8cUHrGcIxrzV/fReTrLrKg0EsRs14T90 jSP6Vk3CA8nepPSmAkxjTGgTfQg96aIuGazWNOAS7uqFYhBkH1wWypXBQ39Ic1fhzeyxzm C3N9bzk4nYYHfHXNzJ2ojhosLGLRjci4pP33eOyzWecrHpGZtluICMp2CTnHLnM8koZUZE q0A/t082NmmyoGAjYFko5peYnE2/6wyD9+G/zy8XLoGVMyQ5MT4FlalcN0MNDg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1715472512; a=rsa-sha256; cv=none; b=B2TWFm3/zBTDr4u2nB32KkEnZAgqtO2XMx3IKOTxcqt1lcqcMm6VBqD2SPF0etDNzUhojH pb2mz3SSUI/vRCwFb9QnHyOuYiyWM4JOj4a0Uqo0pPFbCiS89BRNAdBk3ZMz7zILJnccQj tjuOZ2177DTKn7OEXrpvxvrPoEYc963CRGO+D96nxNU/bqxmn/+P5S6Le1AIVYLchcI1yj 7VAEYNq4OQAc9YMQEB2+j3KW8ANxwM+sCJcykIYe8xwZ7/pxMUbDIDpAnHeFUvVCWrIpFd LPT5Qd4jLYsczPSz8hDO5fJ4G0JEKuGxNJCZEAwsFXv+9vyJY99YGq0m5Gw+PA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1715472511; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=bzdgC4Lk2o0zgI9wkhVmjtW/Awwx6q+9hBDuwZx56lI=; b=KEPlGtKqs413rTPwX7KluNLp3HFO/sCBohrB497iwX0KT3MhrCT+TH47P7Q7/T9sbQDaHJ x4KiRXjA09LYzJkvD9GUEPfLTtbuEPvjdOkz9QWQjaMWnBF75TrDsd+ArT3OtmfNVahbVg CJtCmHypMD7xrbK8HcTFvg9cgkbdO9P/NB/sZrrZxQg1jYnMJ7a+XaP7BrtPIKp5rqc0Kw d34c3Ojq0ACCx7A5mRLLzS4s7D8v1AR07XXYxNmfZb7yf80Cw5NR0Y/jhC0YvCqFnK+r1S U1bg9F1P0fUSJljpa7He/+AOBOgmFeZAhJYj81PV6nLIeiKZnQgzXKoM5h6lPg== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4VcNHz5XryzhF3; Sun, 12 May 2024 00:08:31 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.17.1/8.17.1) with ESMTP id 44C08V6q001986; Sun, 12 May 2024 00:08:31 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.17.1/8.17.1/Submit) id 44C08VFE001983; Sun, 12 May 2024 00:08:31 GMT (envelope-from git) Date: Sun, 12 May 2024 00:08:31 GMT Message-Id: <202405120008.44C08VFE001983@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Jake Freeland Subject: git: c3ee50b705b8 - stable/14 - ktrace: Record socket violations with KTR_CAPFAIL List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: jfree X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: c3ee50b705b8809a38516de5de3fd564f5ee32e0 Auto-Submitted: auto-generated The branch stable/14 has been updated by jfree: URL: https://cgit.FreeBSD.org/src/commit/?id=c3ee50b705b8809a38516de5de3fd564f5ee32e0 commit c3ee50b705b8809a38516de5de3fd564f5ee32e0 Author: Jake Freeland AuthorDate: 2024-04-06 18:31:28 +0000 Commit: Jake Freeland CommitDate: 2024-05-11 23:57:44 +0000 ktrace: Record socket violations with KTR_CAPFAIL Report restricted access to socket addresses and protocols while Capsicum violation tracing with CAPFAIL_ADDR and CAPFAIL_PROTO. Reviewed by: markj Approved by: markj (mentor) MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D40681 (cherry picked from commit aa32d7cbc92c818622462635641d240ae4342eb2) --- sys/kern/uipc_socket.c | 9 +++++++-- sys/kern/uipc_syscalls.c | 13 ++++++++----- 2 files changed, 15 insertions(+), 7 deletions(-) diff --git a/sys/kern/uipc_socket.c b/sys/kern/uipc_socket.c index 5faf018dca11..32a6ff14bb43 100644 --- a/sys/kern/uipc_socket.c +++ b/sys/kern/uipc_socket.c @@ -106,6 +106,7 @@ #include "opt_inet.h" #include "opt_inet6.h" #include "opt_kern_tls.h" +#include "opt_ktrace.h" #include "opt_sctp.h" #include @@ -524,8 +525,12 @@ socreate(int dom, struct socket **aso, int type, int proto, MPASS(prp->pr_attach); - if (IN_CAPABILITY_MODE(td) && (prp->pr_flags & PR_CAPATTACH) == 0) - return (ECAPMODE); + if ((prp->pr_flags & PR_CAPATTACH) == 0) { + if (CAP_TRACING(td)) + ktrcapfail(CAPFAIL_PROTO, &proto); + if (IN_CAPABILITY_MODE(td)) + return (ECAPMODE); + } if (prison_check_af(cred, prp->pr_domain->dom_family) != 0) return (EPROTONOSUPPORT); diff --git a/sys/kern/uipc_syscalls.c b/sys/kern/uipc_syscalls.c index 70a7ebbee4ed..6c13740d8094 100644 --- a/sys/kern/uipc_syscalls.c +++ b/sys/kern/uipc_syscalls.c @@ -673,11 +673,6 @@ sendit(struct thread *td, int s, struct msghdr *mp, int flags) struct sockaddr *to; int error; -#ifdef CAPABILITY_MODE - if (IN_CAPABILITY_MODE(td) && (mp->msg_name != NULL)) - return (ECAPMODE); -#endif - if (mp->msg_name != NULL) { error = getsockaddr(&to, mp->msg_name, mp->msg_namelen); if (error != 0) { @@ -685,6 +680,14 @@ sendit(struct thread *td, int s, struct msghdr *mp, int flags) goto bad; } mp->msg_name = to; +#ifdef CAPABILITY_MODE + if (CAP_TRACING(td)) + ktrcapfail(CAPFAIL_SOCKADDR, mp->msg_name); + if (IN_CAPABILITY_MODE(td)) { + error = ECAPMODE; + goto bad; + } +#endif } else { to = NULL; }