diff options
author | rwatson <rwatson@FreeBSD.org> | 2000-06-04 04:28:31 +0000 |
---|---|---|
committer | rwatson <rwatson@FreeBSD.org> | 2000-06-04 04:28:31 +0000 |
commit | e08a87a21b5ed1bf4a066c22e2928b92fe31e4af (patch) | |
tree | c6932963e6e68891531394b83370c1f675af2c8a /sys/kern/uipc_socket.c | |
parent | aa01bf29bde9e8389bb998fc87d752c6a2cfb018 (diff) | |
download | FreeBSD-src-e08a87a21b5ed1bf4a066c22e2928b92fe31e4af.zip FreeBSD-src-e08a87a21b5ed1bf4a066c22e2928b92fe31e4af.tar.gz |
o Modify jail to limit creation of sockets to UNIX domain sockets,
TCP/IP (v4) sockets, and routing sockets. Previously, interaction
with IPv6 was not well-defined, and might be inappropriate for some
environments. Similarly, sysctl MIB entries providing interface
information also give out only addresses from those protocol domains.
For the time being, this functionality is enabled by default, and
toggleable using the sysctl variable jail.socket_unixiproute_only.
In the future, protocol domains will be able to determine whether or
not they are ``jail aware''.
o Further limitations on process use of getpriority() and setpriority()
by jailed processes. Addresses problem described in kern/17878.
Reviewed by: phk, jmg
Diffstat (limited to 'sys/kern/uipc_socket.c')
-rw-r--r-- | sys/kern/uipc_socket.c | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/sys/kern/uipc_socket.c b/sys/kern/uipc_socket.c index 76495e1..7313811 100644 --- a/sys/kern/uipc_socket.c +++ b/sys/kern/uipc_socket.c @@ -53,6 +53,7 @@ #include <sys/signalvar.h> #include <sys/sysctl.h> #include <sys/uio.h> +#include <sys/jail.h> #include <vm/vm_zone.h> #include <machine/limits.h> @@ -133,6 +134,14 @@ socreate(dom, aso, type, proto, p) prp = pffindproto(dom, proto, type); else prp = pffindtype(dom, type); + + if (p->p_prison && jail_socket_unixiproute_only && + prp->pr_domain->dom_family != PF_LOCAL && + prp->pr_domain->dom_family != PF_INET && + prp->pr_domain->dom_family != PF_ROUTE) { + return (EPROTONOSUPPORT); + } + if (prp == 0 || prp->pr_usrreqs->pru_attach == 0) return (EPROTONOSUPPORT); if (prp->pr_type != type) |