diff options
| -rw-r--r-- | sys/kern/vfs_syscalls.c | 7 | ||||
| -rw-r--r-- | sys/sys/capability.h | 3 |
2 files changed, 6 insertions, 4 deletions
diff --git a/sys/kern/vfs_syscalls.c b/sys/kern/vfs_syscalls.c index c47af7a..7dafc58 100644 --- a/sys/kern/vfs_syscalls.c +++ b/sys/kern/vfs_syscalls.c @@ -1334,7 +1334,7 @@ restart: bwillwrite(); NDINIT_ATRIGHTS(&nd, CREATE, LOCKPARENT | SAVENAME | MPSAFE | AUDITVNODE1, pathseg, path, fd, - CAP_MKFIFO, td); + CAP_MKNOD, td); if ((error = namei(&nd)) != 0) return (error); vfslocked = NDHASGIANT(&nd); @@ -1458,8 +1458,9 @@ kern_mkfifoat(struct thread *td, int fd, char *path, enum uio_seg pathseg, AUDIT_ARG_MODE(mode); restart: bwillwrite(); - NDINIT_AT(&nd, CREATE, LOCKPARENT | SAVENAME | MPSAFE | AUDITVNODE1, - pathseg, path, fd, td); + NDINIT_ATRIGHTS(&nd, CREATE, + LOCKPARENT | SAVENAME | MPSAFE | AUDITVNODE1, pathseg, path, fd, + CAP_MKFIFO, td); if ((error = namei(&nd)) != 0) return (error); vfslocked = NDHASGIANT(&nd); diff --git a/sys/sys/capability.h b/sys/sys/capability.h index 81446a2..a163c4c 100644 --- a/sys/sys/capability.h +++ b/sys/sys/capability.h @@ -81,6 +81,7 @@ #define CAP_MKDIR 0x0000000000200000ULL #define CAP_RMDIR 0x0000000000400000ULL #define CAP_MKFIFO 0x0000000000800000ULL +#define CAP_MKNOD 0x0080000000000000ULL /* Lookups - used to constrain *at() calls. */ #define CAP_LOOKUP 0x0000000001000000ULL @@ -137,7 +138,7 @@ #define CAP_PDKILL 0x0040000000000000ULL /* The mask of all valid method rights. */ -#define CAP_MASK_VALID 0x007fffffffffffffULL +#define CAP_MASK_VALID 0x00ffffffffffffffULL #ifdef _KERNEL |
