diff options
author | pjd <pjd@FreeBSD.org> | 2013-03-02 21:11:30 +0000 |
---|---|---|
committer | pjd <pjd@FreeBSD.org> | 2013-03-02 21:11:30 +0000 |
commit | 702516e70b2669b5076691a0b760b4a37a8c06a2 (patch) | |
tree | 5dbc48bdb7b78718e22183ef377b76f2e3bc74c2 /sys/sys | |
parent | 5026b7b931be858ac65f951dc40069f970064606 (diff) | |
download | FreeBSD-src-702516e70b2669b5076691a0b760b4a37a8c06a2.zip FreeBSD-src-702516e70b2669b5076691a0b760b4a37a8c06a2.tar.gz |
- Implement two new system calls:
int bindat(int fd, int s, const struct sockaddr *addr, socklen_t addrlen);
int connectat(int fd, int s, const struct sockaddr *name, socklen_t namelen);
which allow to bind and connect respectively to a UNIX domain socket with a
path relative to the directory associated with the given file descriptor 'fd'.
- Add manual pages for the new syscalls.
- Make the new syscalls available for processes in capability mode sandbox.
- Add capability rights CAP_BINDAT and CAP_CONNECTAT that has to be present on
the directory descriptor for the syscalls to work.
- Update audit(4) to support those two new syscalls and to handle path
in sockaddr_un structure relative to the given directory descriptor.
- Update procstat(1) to recognize the new capability rights.
- Document the new capability rights in cap_rights_limit(2).
Sponsored by: The FreeBSD Foundation
Discussed with: rwatson, jilles, kib, des
Diffstat (limited to 'sys/sys')
-rw-r--r-- | sys/sys/capability.h | 11 | ||||
-rw-r--r-- | sys/sys/protosw.h | 8 | ||||
-rw-r--r-- | sys/sys/socket.h | 2 | ||||
-rw-r--r-- | sys/sys/socketvar.h | 4 |
4 files changed, 22 insertions, 3 deletions
diff --git a/sys/sys/capability.h b/sys/sys/capability.h index 27e56c2..0d1ea5c 100644 --- a/sys/sys/capability.h +++ b/sys/sys/capability.h @@ -182,13 +182,18 @@ #define CAP_PDWAIT 0x0020000000000000ULL #define CAP_PDKILL 0x0040000000000000ULL +/* + * Rights that allow to use bindat(2) and connectat(2) syscalls on a + * directory descriptor. + */ +#define CAP_BINDAT 0x0400000000000000ULL +#define CAP_CONNECTAT 0x0800000000000000ULL + /* The mask of all valid method rights. */ -#define CAP_MASK_VALID 0x03ffffffffffffffULL +#define CAP_MASK_VALID 0x0fffffffffffffffULL #define CAP_ALL CAP_MASK_VALID /* Available bits. */ -#define CAP_UNUSED5 0x0400000000000000ULL -#define CAP_UNUSED4 0x0800000000000000ULL #define CAP_UNUSED3 0x1000000000000000ULL #define CAP_UNUSED2 0x2000000000000000ULL #define CAP_UNUSED1 0x4000000000000000ULL diff --git a/sys/sys/protosw.h b/sys/sys/protosw.h index 78d6e06..8553baf 100644 --- a/sys/sys/protosw.h +++ b/sys/sys/protosw.h @@ -223,6 +223,10 @@ struct pr_usrreqs { struct ucred *cred, struct thread *td); void (*pru_sosetlabel)(struct socket *so); void (*pru_close)(struct socket *so); + int (*pru_bindat)(int fd, struct socket *so, struct sockaddr *nam, + struct thread *td); + int (*pru_connectat)(int fd, struct socket *so, + struct sockaddr *nam, struct thread *td); }; /* @@ -232,8 +236,12 @@ int pru_accept_notsupp(struct socket *so, struct sockaddr **nam); int pru_attach_notsupp(struct socket *so, int proto, struct thread *td); int pru_bind_notsupp(struct socket *so, struct sockaddr *nam, struct thread *td); +int pru_bindat_notsupp(int fd, struct socket *so, struct sockaddr *nam, + struct thread *td); int pru_connect_notsupp(struct socket *so, struct sockaddr *nam, struct thread *td); +int pru_connectat_notsupp(int fd, struct socket *so, struct sockaddr *nam, + struct thread *td); int pru_connect2_notsupp(struct socket *so1, struct socket *so2); int pru_control_notsupp(struct socket *so, u_long cmd, caddr_t data, struct ifnet *ifp, struct thread *td); diff --git a/sys/sys/socket.h b/sys/sys/socket.h index c29a689..632dae4 100644 --- a/sys/sys/socket.h +++ b/sys/sys/socket.h @@ -620,7 +620,9 @@ struct sf_hdtr { __BEGIN_DECLS int accept(int, struct sockaddr * __restrict, socklen_t * __restrict); int bind(int, const struct sockaddr *, socklen_t); +int bindat(int, int, const struct sockaddr *, socklen_t); int connect(int, const struct sockaddr *, socklen_t); +int connectat(int, int, const struct sockaddr *, socklen_t); int getpeername(int, struct sockaddr * __restrict, socklen_t * __restrict); int getsockname(int, struct sockaddr * __restrict, socklen_t * __restrict); int getsockopt(int, int, int, void * __restrict, socklen_t * __restrict); diff --git a/sys/sys/socketvar.h b/sys/sys/socketvar.h index 9012f240..77f31df 100644 --- a/sys/sys/socketvar.h +++ b/sys/sys/socketvar.h @@ -318,8 +318,12 @@ void soabort(struct socket *so); int soaccept(struct socket *so, struct sockaddr **nam); int socheckuid(struct socket *so, uid_t uid); int sobind(struct socket *so, struct sockaddr *nam, struct thread *td); +int sobindat(int fd, struct socket *so, struct sockaddr *nam, + struct thread *td); int soclose(struct socket *so); int soconnect(struct socket *so, struct sockaddr *nam, struct thread *td); +int soconnectat(int fd, struct socket *so, struct sockaddr *nam, + struct thread *td); int soconnect2(struct socket *so1, struct socket *so2); int socow_setup(struct mbuf *m0, struct uio *uio); int socreate(int dom, struct socket **aso, int type, int proto, |