diff options
| author | pjd <pjd@FreeBSD.org> | 2012-09-25 20:48:49 +0000 |
|---|---|---|
| committer | pjd <pjd@FreeBSD.org> | 2012-09-25 20:48:49 +0000 |
| commit | 76c124139fab4f40b1949989f2ea84b3c11ad84c (patch) | |
| tree | b11cd41865f4b2fe90c719eb2a372afa3e412105 /sys/kern/vfs_syscalls.c | |
| parent | 4149ca24699a35b4acb7629aafd0bf4d716859be (diff) | |
| download | FreeBSD-src-76c124139fab4f40b1949989f2ea84b3c11ad84c.zip FreeBSD-src-76c124139fab4f40b1949989f2ea84b3c11ad84c.tar.gz | |
O_EXEC flag is not part of the O_ACCMODE mask, check it separately.
If O_EXEC is provided don't require CAP_READ/CAP_WRITE, as O_EXEC
is mutually exclusive to O_RDONLY/O_WRONLY/O_RDWR.
Without this change CAP_FEXECVE capability right is not enforced.
Sponsored by: FreeBSD Foundation
MFC after: 3 days
Diffstat (limited to 'sys/kern/vfs_syscalls.c')
| -rw-r--r-- | sys/kern/vfs_syscalls.c | 28 |
1 files changed, 13 insertions, 15 deletions
diff --git a/sys/kern/vfs_syscalls.c b/sys/kern/vfs_syscalls.c index cc6d93c..e518d58 100644 --- a/sys/kern/vfs_syscalls.c +++ b/sys/kern/vfs_syscalls.c @@ -1006,22 +1006,20 @@ flags_to_rights(int flags) { cap_rights_t rights = 0; - switch ((flags & O_ACCMODE)) { - case O_RDONLY: - rights |= CAP_READ; - break; - - case O_RDWR: - rights |= CAP_READ; - /* fall through */ - - case O_WRONLY: - rights |= CAP_WRITE; - break; - - case O_EXEC: + if (flags & O_EXEC) { rights |= CAP_FEXECVE; - break; + } else { + switch ((flags & O_ACCMODE)) { + case O_RDONLY: + rights |= CAP_READ; + break; + case O_RDWR: + rights |= CAP_READ; + /* FALLTHROUGH */ + case O_WRONLY: + rights |= CAP_WRITE; + break; + } } if (flags & O_CREAT) |
