PERFORCE change 171267 for review

[Jonathan Anderson]

http://p4web.freebsd.org/chv.cgi?CH=171267

Change 171267 by jona at jona-capsicum-belle64-ufs on 2009/12/02 13:41:19

	Enable faccessat(2) in capability mode

Affected files ...

.. //depot/projects/trustedbsd/capabilities/TODO#16 edit
.. //depot/projects/trustedbsd/capabilities/src/sys/kern/capabilities.conf#23 edit
.. //depot/projects/trustedbsd/capabilities/src/sys/kern/init_sysent.c#43 edit
.. //depot/projects/trustedbsd/capabilities/src/sys/kern/vfs_syscalls.c#19 edit

Differences ...

==== //depot/projects/trustedbsd/capabilities/TODO#16 (text+ko) ====

@@ -28,7 +28,7 @@
 Low-level TODO list:
 
 - Add support for capability-mode *at() system calls:
-  faccessat	INPROGRESS			JA
+  faccessat	DONE		2 Dec 2009	JA
   fchmodat	----
   fchownat	----
   fstatat	----

==== //depot/projects/trustedbsd/capabilities/src/sys/kern/capabilities.conf#23 (text+ko) ====

@@ -38,7 +38,7 @@
 ## - sys_exit(2), abort2(2) and close(2) are very important.
 ## - Sorted alphabetically, please keep it that way.
 ##
-## $P4: //depot/projects/trustedbsd/capabilities/src/sys/kern/capabilities.conf#22 $
+## $P4: //depot/projects/trustedbsd/capabilities/src/sys/kern/capabilities.conf#23 $
 ##
 
 ##
@@ -453,9 +453,10 @@
 olio_listio
 
 ##
-## Allow openat(2), which we have constrained to prevent accessing files
-## which are not "under" the directory FD given to the syscall.
+## Allow faccessat(2) and openat(2), which we have constrained to prevent accessing
+## files which are not "under" the directory FD given to the syscall.
 ##
+faccessat
 openat
 
 ##

==== //depot/projects/trustedbsd/capabilities/src/sys/kern/init_sysent.c#43 (text+ko) ====

@@ -523,7 +523,7 @@
 	{ AS(cpuset_getid_args), (sy_call_t *)cpuset_getid, AUE_NULL, NULL, 0, 0, 0 },	/* 486 = cpuset_getid */
 	{ AS(cpuset_getaffinity_args), (sy_call_t *)cpuset_getaffinity, AUE_NULL, NULL, 0, 0, 0 },	/* 487 = cpuset_getaffinity */
 	{ AS(cpuset_setaffinity_args), (sy_call_t *)cpuset_setaffinity, AUE_NULL, NULL, 0, 0, 0 },	/* 488 = cpuset_setaffinity */
-	{ AS(faccessat_args), (sy_call_t *)faccessat, AUE_FACCESSAT, NULL, 0, 0, 0 },	/* 489 = faccessat */
+	{ AS(faccessat_args), (sy_call_t *)faccessat, AUE_FACCESSAT, NULL, 0, 0, SYF_CAPENABLED },	/* 489 = faccessat */
 	{ AS(fchmodat_args), (sy_call_t *)fchmodat, AUE_FCHMODAT, NULL, 0, 0, 0 },	/* 490 = fchmodat */
 	{ AS(fchownat_args), (sy_call_t *)fchownat, AUE_FCHOWNAT, NULL, 0, 0, 0 },	/* 491 = fchownat */
 	{ AS(fexecve_args), (sy_call_t *)fexecve, AUE_FEXECVE, NULL, 0, 0, SYF_CAPENABLED },	/* 492 = fexecve */

==== //depot/projects/trustedbsd/capabilities/src/sys/kern/vfs_syscalls.c#19 (text+ko) ====

@@ -2219,7 +2219,7 @@
     int flags, int mode)
 {
 	struct ucred *cred, *tmpcred;
-	struct vnode *vp;
+	struct vnode *vp, *base = 0;
 	struct nameidata nd;
 	int vfslocked;
 	int error;
@@ -2238,8 +2238,25 @@
 	} else
 		cred = tmpcred = td->td_ucred;
 	AUDIT_ARG_VALUE(mode);
-	NDINIT_AT(&nd, LOOKUP, FOLLOW | LOCKSHARED | LOCKLEAF | MPSAFE |
-	    AUDITVNODE1, pathseg, path, fd, td);
+
+	/*
+	 * if a relative base was specified and we're in capability mode, find
+	 * the vnode of the base so that namei() can restrict itself accordingly
+	 */
+	if ((cred->cr_flags & CRED_FLAG_CAPMODE) && (fd >= 0)) {
+
+		if ((error = fgetvp(td, fd, CAP_LOOKUP | CAP_ATBASE, &base)))
+			/* XXX: more CAP_FOO? */
+			return (error);
+
+		if ((error = vn_lock(base, LK_SHARED))) {
+			vrele (base);
+			return (error);
+		}
+	}
+
+	NDINIT_ATBASE(&nd, LOOKUP, FOLLOW | LOCKSHARED | LOCKLEAF | MPSAFE |
+	    AUDITVNODE1, pathseg, path, fd, base, td);
 	if ((error = namei(&nd)) != 0)
 		goto out1;
 	vfslocked = NDHASGIANT(&nd);
@@ -2254,6 +2271,7 @@
 		td->td_ucred = cred;
 		crfree(tmpcred);
 	}
+	if (base) vput(base);
 	return (error);
 }