diff options
| author | wsalamon <wsalamon@FreeBSD.org> | 2006-09-01 11:45:40 +0000 |
|---|---|---|
| committer | wsalamon <wsalamon@FreeBSD.org> | 2006-09-01 11:45:40 +0000 |
| commit | c62317c442340f5e4627b6020679dc03d49a3918 (patch) | |
| tree | 17f9a899743e9577c2e64080d7c7f0a957fbe0f4 /sys/kern/kern_exec.c | |
| parent | e279989d710de9f19f0e36445d579caea48bf429 (diff) | |
| download | FreeBSD-src-c62317c442340f5e4627b6020679dc03d49a3918.zip FreeBSD-src-c62317c442340f5e4627b6020679dc03d49a3918.tar.gz | |
Audit the argv and env vectors passed in on exec:
Add the argument auditing functions for argv and env.
Add kernel-specific versions of the tokenizer functions for the
arg and env represented as a char array.
Implement the AUDIT_ARGV and AUDIT_ARGE audit policy commands to
enable/disable argv/env auditing.
Call the argument auditing from the exec system calls.
Obtained from: TrustedBSD Project
Approved by: rwatson (mentor)
Diffstat (limited to 'sys/kern/kern_exec.c')
| -rw-r--r-- | sys/kern/kern_exec.c | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/sys/kern/kern_exec.c b/sys/kern/kern_exec.c index d8f196b..9bd3104 100644 --- a/sys/kern/kern_exec.c +++ b/sys/kern/kern_exec.c @@ -79,6 +79,8 @@ __FBSDID("$FreeBSD$"); #include <machine/reg.h> +#include <security/audit/audit.h> + MALLOC_DEFINE(M_PARGS, "proc-args", "Process arguments"); static int sysctl_kern_ps_strings(SYSCTL_HANDLER_ARGS); @@ -239,6 +241,10 @@ kern_execve(td, args, mac_p) struct proc *p = td->td_proc; int error; + AUDIT_ARG(argv, args->begin_argv, args->argc, + args->begin_envv - args->begin_argv); + AUDIT_ARG(envv, args->begin_envv, args->envc, + args->endp - args->begin_envv); if (p->p_flag & P_HADTHREADS) { PROC_LOCK(p); if (thread_single(SINGLE_BOUNDARY)) { @@ -351,6 +357,9 @@ do_execve(td, args, mac_p) /* * Translate the file name. namei() returns a vnode pointer * in ni_vp amoung other things. + * + * XXXAUDIT: It would be desirable to also audit the name of the + * interpreter if this is an interpreted binary. */ ndp = &nd; NDINIT(ndp, LOOKUP, ISOPEN | LOCKLEAF | FOLLOW | SAVENAME | MPSAFE | |
