o Disallow two "allow this" exceptions in p_cansignal() restricting

  the ability of unprivileged processes to deliver arbitrary signals
  to daemons temporarily taking on unprivileged effective credentials
  when P_SUGID is not set on the target process:
  Removed:
     (p1->p_cred->cr_ruid != ps->p_cred->cr_uid)
     (p1->p_ucred->cr_uid != ps->p_cred->cr_uid)
o Replace two "allow this" exceptions in p_cansignal() restricting
  the ability of unprivileged processes to deliver arbitrary signals
  to daemons temporarily taking on unprivileged effective credentials
  when P_SUGID is set on the target process:
  Replaced:
     (p1->p_cred->p_ruid != p2->p_ucred->cr_uid)
     (p1->p_cred->cr_uid != p2->p_ucred->cr_uid)
  With:
     (p1->p_cred->p_ruid != p2->p_ucred->p_svuid)
     (p1->p_ucred->cr_uid != p2->p_ucred->p_svuid)
o These changes have the effect of making the uid-based handling of
  both P_SUGID and non-P_SUGID signal delivery consistent, following
  these four general cases:
     p1's ruid equals p2's ruid
     p1's euid equals p2's ruid
     p1's ruid equals p2's svuid
     p1's euid equals p2's svuid
  The P_SUGID and non-P_SUGID cases can now be largely collapsed,
  and I'll commit this in a few days if no immediate problems are
  encountered with this set of changes.
o These changes remove a number of warning cases identified by the
  proc_to_proc inter-process authorization regression test.
o As these are new restrictions, we'll have to watch out carefully for
  possible side effects on running code: they seem reasonable to me,
  but it's possible this change might have to be backed out if problems
  are experienced.

Submitted by:		src/tools/regression/security/proc_to_proc/testuid
Reviewed by:		tmm
Obtained from:	TrustedBSD Project

1 files changed, 3 insertions, 5 deletions

diff --git a/sys/kern/kern_prot.c b/sys/kern/kern_prot.c
index 75c1f70..c86e875 100644
--- a/sys/kern/kern_prot.c
+++ b/sys/kern/kern_prot.c
@@ -1084,8 +1084,8 @@ p_cansignal(struct proc *p1, struct proc *p2, int signum)
 			 */
 			if (p1->p_cred->p_ruid != p2->p_cred->p_ruid &&
 			    p1->p_ucred->cr_uid != p2->p_cred->p_ruid &&
-			    p1->p_cred->p_ruid != p2->p_ucred->cr_uid &&
-			    p1->p_ucred->cr_uid != p2->p_ucred->cr_uid) {
+			    p1->p_cred->p_ruid != p2->p_cred->p_svuid &&
+			    p1->p_ucred->cr_uid != p2->p_cred->p_svuid) {
 				/* Not permitted, try privilege. */
 				error = suser_xxx(NULL, p1, PRISON_ROOT);
 				if (error)
@@ -1106,9 +1106,7 @@ p_cansignal(struct proc *p1, struct proc *p2, int signum)
 		if (p1->p_cred->p_ruid != p2->p_cred->p_ruid &&
 		    p1->p_cred->p_ruid != p2->p_cred->p_svuid &&
 		    p1->p_ucred->cr_uid != p2->p_cred->p_ruid &&
-		    p1->p_ucred->cr_uid != p2->p_cred->p_svuid &&
-		    p1->p_cred->p_ruid != p2->p_ucred->cr_uid &&
-		    p1->p_ucred->cr_uid != p2->p_ucred->cr_uid) {
+		    p1->p_ucred->cr_uid != p2->p_cred->p_svuid) {
 			/* Not permitted, try privilege. */
 			error = suser_xxx(NULL, p1, PRISON_ROOT);
 			if (error)