diff options
author | sef <sef@FreeBSD.org> | 1997-08-12 04:34:30 +0000 |
---|---|---|
committer | sef <sef@FreeBSD.org> | 1997-08-12 04:34:30 +0000 |
commit | ea579a477de5aabed2fd91f73b46be6afbfb2f6d (patch) | |
tree | eac6c582162dcbb910c93ef9d2afc40c754971e4 /sys/fs/procfs/procfs_mem.c | |
parent | 4777af062a5f7f20d37d43b4c740b59b084caba0 (diff) | |
download | FreeBSD-src-ea579a477de5aabed2fd91f73b46be6afbfb2f6d.zip FreeBSD-src-ea579a477de5aabed2fd91f73b46be6afbfb2f6d.tar.gz |
Fix procfs security hole -- check permissions on meaningful I/Os (namely,
reading/writing of mem and regs). Also have to check for the requesting
process being group KMEM -- this is a bit of a hack, but ps et al need it.
Reviewed by: davidg
Diffstat (limited to 'sys/fs/procfs/procfs_mem.c')
-rw-r--r-- | sys/fs/procfs/procfs_mem.c | 19 |
1 files changed, 18 insertions, 1 deletions
diff --git a/sys/fs/procfs/procfs_mem.c b/sys/fs/procfs/procfs_mem.c index 97b7d9b..1a9d6ab 100644 --- a/sys/fs/procfs/procfs_mem.c +++ b/sys/fs/procfs/procfs_mem.c @@ -37,7 +37,7 @@ * * @(#)procfs_mem.c 8.5 (Berkeley) 6/15/94 * - * $Id: procfs_mem.c,v 1.25 1997/04/20 17:12:11 dyson Exp $ + * $Id: procfs_mem.c,v 1.26 1997/08/02 14:32:14 bde Exp $ */ /* @@ -277,6 +277,23 @@ procfs_domem(curp, p, pfs, uio) if (uio->uio_resid == 0) return (0); + /* + * XXX + * We need to check for KMEM_GROUP because ps is sgid kmem; + * not allowing it here causes ps to not work properly. Arguably, + * this is a bug with what ps does. We only need to do this + * for Pmem nodes, and only if it's reading. This is still not + * good, as it may still be possible to grab illicit data if + * a process somehow gets to be KMEM_GROUP. Note that this also + * means that KMEM_GROUP can't change without editing procfs.h! + * All in all, quite yucky. + */ + + if (!CHECKIO(curp, p) && + !(curp->p_cred->pc_ucred->cr_gid == KMEM_GROUP && + uio->uio_rw == UIO_READ)) + return EPERM; + return (procfs_rwmem(p, uio)); } |