cvs commit: src/sys/netinet ip_mroute.c raw_ip.c

[Christian S.J. Peron]

csjp        2004-08-21 17:37:44 UTC

  FreeBSD src repository

  Modified files:
    sys/netinet          ip_mroute.c raw_ip.c 
  Log:
  When a prison is given the ability to create raw sockets (when the
  security.jail.allow_raw_sockets sysctl MIB is set to 1) where privileged
  access to jails is given out, it is possible for prison root to manipulate
  various network parameters which effect the host environment. This commit
  plugs a number of security holes associated with the use of raw sockets
  and prisons.
  
  This commit makes the following changes:
  
  - Add a comment to rtioctl warning developers that if they add
    any ioctl commands, they should use super-user checks where necessary,
    as it is possible for PRISON root to make it this far in execution.
  - Add super-user checks for the execution of the SIOCGETVIFCNT
    and SIOCGETSGCNT IP multicast ioctl commands.
  - Add a super-user check to rip_ctloutput(). If the calling cred
    is PRISON root, make sure the socket option name is IP_HDRINCL,
    otherwise deny the request.
  
  Although this patch corrects a number of security problems associated
  with raw sockets and prisons, the warning in jail(8) should still
  apply, and by default we should keep the default value of
  security.jail.allow_raw_sockets MIB to 0 (or disabled) until
  we are certain that we have tracked down all the problems.
  
  Looking forward, we will probably want to eliminate the
  references to curthread.
  
  This may be a MFC candidate for RELENG_5.
  
  Reviewed by:    rwatson
  Approved by:    bmilekic (mentor)
  
  Revision  Changes    Path
  1.107     +8 -0      src/sys/netinet/ip_mroute.c
  1.143     +10 -0     src/sys/netinet/raw_ip.c