summaryrefslogtreecommitdiffstats
path: root/sys/fs/procfs/procfs_mem.c
diff options
context:
space:
mode:
authorsef <sef@FreeBSD.org>1997-08-12 04:34:30 +0000
committersef <sef@FreeBSD.org>1997-08-12 04:34:30 +0000
commitea579a477de5aabed2fd91f73b46be6afbfb2f6d (patch)
treeeac6c582162dcbb910c93ef9d2afc40c754971e4 /sys/fs/procfs/procfs_mem.c
parent4777af062a5f7f20d37d43b4c740b59b084caba0 (diff)
downloadFreeBSD-src-ea579a477de5aabed2fd91f73b46be6afbfb2f6d.zip
FreeBSD-src-ea579a477de5aabed2fd91f73b46be6afbfb2f6d.tar.gz
Fix procfs security hole -- check permissions on meaningful I/Os (namely,
reading/writing of mem and regs). Also have to check for the requesting process being group KMEM -- this is a bit of a hack, but ps et al need it. Reviewed by: davidg
Diffstat (limited to 'sys/fs/procfs/procfs_mem.c')
-rw-r--r--sys/fs/procfs/procfs_mem.c19
1 files changed, 18 insertions, 1 deletions
diff --git a/sys/fs/procfs/procfs_mem.c b/sys/fs/procfs/procfs_mem.c
index 97b7d9b..1a9d6ab 100644
--- a/sys/fs/procfs/procfs_mem.c
+++ b/sys/fs/procfs/procfs_mem.c
@@ -37,7 +37,7 @@
*
* @(#)procfs_mem.c 8.5 (Berkeley) 6/15/94
*
- * $Id: procfs_mem.c,v 1.25 1997/04/20 17:12:11 dyson Exp $
+ * $Id: procfs_mem.c,v 1.26 1997/08/02 14:32:14 bde Exp $
*/
/*
@@ -277,6 +277,23 @@ procfs_domem(curp, p, pfs, uio)
if (uio->uio_resid == 0)
return (0);
+ /*
+ * XXX
+ * We need to check for KMEM_GROUP because ps is sgid kmem;
+ * not allowing it here causes ps to not work properly. Arguably,
+ * this is a bug with what ps does. We only need to do this
+ * for Pmem nodes, and only if it's reading. This is still not
+ * good, as it may still be possible to grab illicit data if
+ * a process somehow gets to be KMEM_GROUP. Note that this also
+ * means that KMEM_GROUP can't change without editing procfs.h!
+ * All in all, quite yucky.
+ */
+
+ if (!CHECKIO(curp, p) &&
+ !(curp->p_cred->pc_ucred->cr_gid == KMEM_GROUP &&
+ uio->uio_rw == UIO_READ))
+ return EPERM;
+
return (procfs_rwmem(p, uio));
}
OpenPOWER on IntegriCloud