svn commit: r308810 - head/bin/dd

[Adrian Chadd]

fwiw, this breaks -head compilation.



-a


On 18 November 2016 at 13:09, Bartek Rutkowski <robak at freebsd.org> wrote:
> Author: robak (ports committer)
> Date: Fri Nov 18 21:09:57 2016
> New Revision: 308810
> URL: https://svnweb.freebsd.org/changeset/base/308810
>
> Log:
>   Capsicum support for dd(1)
>
>   Adds Capsicum sandboxing to dd utility.
>
>   Submitted by: Pawel Biernacki <pawel.biernacki at gmail.com>
>   Reviewed by:  allanjude, emaste, oshogbo
>   Approved by:  oshogbo
>   Sponsored by: Mysterious Code Ltd.
>   Differential Revision:        https://reviews.freebsd.org/D8543
>
> Modified:
>   head/bin/dd/dd.c
>
> Modified: head/bin/dd/dd.c
> ==============================================================================
> --- head/bin/dd/dd.c    Fri Nov 18 17:18:05 2016        (r308809)
> +++ head/bin/dd/dd.c    Fri Nov 18 21:09:57 2016        (r308810)
> @@ -48,10 +48,13 @@ __FBSDID("$FreeBSD$");
>  #include <sys/param.h>
>  #include <sys/stat.h>
>  #include <sys/conf.h>
> +#include <sys/capsicum.h>
>  #include <sys/disklabel.h>
>  #include <sys/filio.h>
> +#include <sys/mtio.h>
>
>  #include <assert.h>
> +#include <capsicum_helpers.h>
>  #include <ctype.h>
>  #include <err.h>
>  #include <errno.h>
> @@ -92,6 +95,10 @@ main(int argc __unused, char *argv[])
>         jcl(argv);
>         setup();
>
> +       caph_cache_catpages();
> +       if (cap_enter() == -1 && errno != ENOSYS)
> +               err(1, "unable to enter capability mode");
> +
>         (void)signal(SIGINFO, siginfo_handler);
>         (void)signal(SIGINT, terminate);
>
> @@ -125,6 +132,8 @@ static void
>  setup(void)
>  {
>         u_int cnt;
> +       cap_rights_t rights;
> +       unsigned long cmds[] = { FIODTYPE, MTIOCTOP };
>
>         if (in.name == NULL) {
>                 in.name = "stdin";
> @@ -133,13 +142,20 @@ setup(void)
>                 in.fd = open(in.name, O_RDONLY, 0);
>                 if (in.fd == -1)
>                         err(1, "%s", in.name);
> +               if (caph_limit_stdin() == -1)
> +                       err(1, "unable to limit capability rights");
>         }
>
>         getfdtype(&in);
>
> +       cap_rights_init(&rights, CAP_READ, CAP_SEEK);
> +       if (cap_rights_limit(in.fd, &rights) == -1 && errno != ENOSYS)
> +               err(1, "unable to limit capability rights");
> +
>         if (files_cnt > 1 && !(in.flags & ISTAPE))
>                 errx(1, "files is not supported for non-tape devices");
>
> +       cap_rights_set(&rights, CAP_WRITE, CAP_FTRUNCATE, CAP_IOCTL);
>         if (out.name == NULL) {
>                 /* No way to check for read access here. */
>                 out.fd = STDOUT_FILENO;
> @@ -156,13 +172,27 @@ setup(void)
>                 if (out.fd == -1) {
>                         out.fd = open(out.name, O_WRONLY | OFLAGS, DEFFILEMODE);
>                         out.flags |= NOREAD;
> +                       cap_rights_clear(&rights, CAP_READ);
>                 }
>                 if (out.fd == -1)
>                         err(1, "%s", out.name);
> +               if (caph_limit_stdout() == -1)
> +                       err(1, "unable to limit capability rights");
>         }
>
>         getfdtype(&out);
>
> +       if (cap_rights_limit(out.fd, &rights) == -1 && errno != ENOSYS)
> +               err(1, "unable to limit capability rights");
> +       if (cap_ioctls_limit(out.fd, cmds, nitems(cmds)) == -1 &&
> +           errno != ENOSYS)
> +               err(1, "unable to limit capability rights");
> +
> +       if (in.fd != STDERR_FILENO && out.fd != STDERR_FILENO) {
> +               if (caph_limit_stderr() == -1)
> +                       err(1, "unable to limit capability rights");
> +       }
> +
>         /*
>          * Allocate space for the input and output buffers.  If not doing
>          * record oriented I/O, only need a single buffer.
>