diff options
| author | kib <kib@FreeBSD.org> | 2013-10-25 16:36:16 +0000 |
|---|---|---|
| committer | kib <kib@FreeBSD.org> | 2013-10-25 16:36:16 +0000 |
| commit | 47b928f216400825cad00e3435e0c50fcb7ebb58 (patch) | |
| tree | c8b7ebc69047d278896215d856dff9435261c45f /sys/kern/kern_exec.c | |
| parent | 3056ea94bbf733ca0aeeb7772efef40884382338 (diff) | |
| download | FreeBSD-src-47b928f216400825cad00e3435e0c50fcb7ebb58.zip FreeBSD-src-47b928f216400825cad00e3435e0c50fcb7ebb58.tar.gz | |
MFC r256504:
Add a sysctl kern.disallow_high_osrel which disables executing the
images compiled on the world with higher major version number than the
high version number of the booted kernel. Default to disable.
Approved by: re (glebius)
Diffstat (limited to 'sys/kern/kern_exec.c')
| -rw-r--r-- | sys/kern/kern_exec.c | 14 |
1 files changed, 14 insertions, 0 deletions
diff --git a/sys/kern/kern_exec.c b/sys/kern/kern_exec.c index 45f732b..c71c666 100644 --- a/sys/kern/kern_exec.c +++ b/sys/kern/kern_exec.c @@ -123,6 +123,11 @@ u_long ps_arg_cache_limit = PAGE_SIZE / 16; SYSCTL_ULONG(_kern, OID_AUTO, ps_arg_cache_limit, CTLFLAG_RW, &ps_arg_cache_limit, 0, ""); +static int disallow_high_osrel; +SYSCTL_INT(_kern, OID_AUTO, disallow_high_osrel, CTLFLAG_RW, + &disallow_high_osrel, 0, + "Disallow execution of binaries built for higher version of the world"); + static int map_at_zero = 0; TUNABLE_INT("security.bsd.map_at_zero", &map_at_zero); SYSCTL_INT(_security_bsd, OID_AUTO, map_at_zero, CTLFLAG_RW, &map_at_zero, 0, @@ -552,6 +557,15 @@ interpret: vn_fullpath(td, imgp->vp, &imgp->execpath, &imgp->freepath) != 0)) imgp->execpath = args->fname; + if (disallow_high_osrel && + P_OSREL_MAJOR(p->p_osrel) > P_OSREL_MAJOR(__FreeBSD_version)) { + error = ENOEXEC; + uprintf("Osrel %d for image %s too high\n", p->p_osrel, + imgp->execpath != NULL ? imgp->execpath : "<unresolved>"); + vn_lock(imgp->vp, LK_SHARED | LK_RETRY); + goto exec_fail_dealloc; + } + /* * Copy out strings (args and env) and initialize stack base */ |
