diff options
Diffstat (limited to 'sys')
| -rw-r--r-- | sys/kern/kern_exit.c | 4 | ||||
| -rw-r--r-- | sys/kern/kern_prot.c | 31 | ||||
| -rw-r--r-- | sys/security/mac/mac_framework.h | 1 | ||||
| -rw-r--r-- | sys/security/mac/mac_policy.h | 2 | ||||
| -rw-r--r-- | sys/security/mac/mac_process.c | 15 | ||||
| -rw-r--r-- | sys/security/mac_stub/mac_stub.c | 8 | ||||
| -rw-r--r-- | sys/security/mac_test/mac_test.c | 11 | ||||
| -rw-r--r-- | sys/sys/mac.h | 1 | ||||
| -rw-r--r-- | sys/sys/mac_policy.h | 2 | ||||
| -rw-r--r-- | sys/sys/proc.h | 1 |
10 files changed, 76 insertions, 0 deletions
diff --git a/sys/kern/kern_exit.c b/sys/kern/kern_exit.c index e27e9b0..8b31e35 100644 --- a/sys/kern/kern_exit.c +++ b/sys/kern/kern_exit.c @@ -597,6 +597,10 @@ loop: PROC_UNLOCK(p); continue; } + if (p_canwait(td, p)) { + PROC_UNLOCK(p); + continue; + } /* * This special case handles a kthread spawned by linux_clone diff --git a/sys/kern/kern_prot.c b/sys/kern/kern_prot.c index 56ec0dd..ebe4b18 100644 --- a/sys/kern/kern_prot.c +++ b/sys/kern/kern_prot.c @@ -1800,6 +1800,37 @@ cr_canseesocket(struct ucred *cred, struct socket *so) return (0); } +/*- + * Determine whether td can wait for the exit of p. + * Returns: 0 for permitted, an errno value otherwise + * Locks: Sufficient locks to protect various components of td and p + * must be held. td must be curthread, and a lock must + * be held for p. + * References: td and p must be valid for the lifetime of the call + + */ +int +p_canwait(struct thread *td, struct proc *p) +{ + int error; + + KASSERT(td == curthread, ("%s: td not curthread", __func__)); + PROC_LOCK_ASSERT(p, MA_OWNED); + if ((error = prison_check(td->td_ucred, p->p_ucred))) + return (error); +#ifdef MAC + if ((error = mac_check_proc_wait(td->td_ucred, p))) + return (error); +#endif +#if 0 + /* XXXMAC: This could have odd effects on some shells. */ + if ((error = cr_seeotheruids(td->td_ucred, p->p_ucred))) + return (error); +#endif + + return (0); +} + /* * Allocate a zeroed cred structure. * MPSAFE diff --git a/sys/security/mac/mac_framework.h b/sys/security/mac/mac_framework.h index f72733d..8e5037a 100644 --- a/sys/security/mac/mac_framework.h +++ b/sys/security/mac/mac_framework.h @@ -351,6 +351,7 @@ int mac_check_proc_setresgid(struct proc *proc, struct ucred *cred, gid_t rgid, gid_t egid, gid_t sgid); int mac_check_proc_signal(struct ucred *cred, struct proc *proc, int signum); +int mac_check_proc_wait(struct ucred *cred, struct proc *proc); int mac_check_socket_accept(struct ucred *cred, struct socket *so); int mac_check_socket_bind(struct ucred *cred, struct socket *so, struct sockaddr *sockaddr); diff --git a/sys/security/mac/mac_policy.h b/sys/security/mac/mac_policy.h index 402d622..e519cb3 100644 --- a/sys/security/mac/mac_policy.h +++ b/sys/security/mac/mac_policy.h @@ -424,6 +424,8 @@ struct mac_policy_ops { gid_t egid, gid_t sgid); int (*mpo_check_proc_signal)(struct ucred *cred, struct proc *proc, int signum); + int (*mpo_check_proc_wait)(struct ucred *cred, + struct proc *proc); int (*mpo_check_socket_accept)(struct ucred *cred, struct socket *so, struct label *socketlabel); int (*mpo_check_socket_bind)(struct ucred *cred, diff --git a/sys/security/mac/mac_process.c b/sys/security/mac/mac_process.c index 8dda7b1..436c55b 100644 --- a/sys/security/mac/mac_process.c +++ b/sys/security/mac/mac_process.c @@ -650,3 +650,18 @@ mac_check_proc_setresgid(struct proc *proc, struct ucred *cred, gid_t rgid, MAC_CHECK(check_proc_setresgid, cred, rgid, egid, sgid); return (error); } + +int +mac_check_proc_wait(struct ucred *cred, struct proc *proc) +{ + int error; + + PROC_LOCK_ASSERT(proc, MA_OWNED); + + if (!mac_enforce_process) + return (0); + + MAC_CHECK(check_proc_wait, cred, proc); + + return (error); +} diff --git a/sys/security/mac_stub/mac_stub.c b/sys/security/mac_stub/mac_stub.c index 9a7f567..64a06d9 100644 --- a/sys/security/mac_stub/mac_stub.c +++ b/sys/security/mac_stub/mac_stub.c @@ -842,6 +842,13 @@ stub_check_proc_signal(struct ucred *cred, struct proc *proc, int signum) } static int +stub_check_proc_wait(struct ucred *cred, struct proc *proc) +{ + + return (0); +} + +static int stub_check_proc_setuid(struct ucred *cred, uid_t uid) { @@ -1456,6 +1463,7 @@ static struct mac_policy_ops mac_stub_ops = .mpo_check_proc_setresuid = stub_check_proc_setresuid, .mpo_check_proc_setresgid = stub_check_proc_setresgid, .mpo_check_proc_signal = stub_check_proc_signal, + .mpo_check_proc_wait = stub_check_proc_wait, .mpo_check_socket_accept = stub_check_socket_accept, .mpo_check_socket_bind = stub_check_socket_bind, .mpo_check_socket_connect = stub_check_socket_connect, diff --git a/sys/security/mac_test/mac_test.c b/sys/security/mac_test/mac_test.c index 1ce97a3..b2fa853 100644 --- a/sys/security/mac_test/mac_test.c +++ b/sys/security/mac_test/mac_test.c @@ -1791,6 +1791,16 @@ mac_test_check_proc_setresgid(struct ucred *cred, gid_t rgid, gid_t egid, } static int +mac_test_check_proc_wait(struct ucred *cred, struct proc *proc) +{ + + ASSERT_CRED_LABEL(cred->cr_label); + ASSERT_CRED_LABEL(proc->p_ucred->cr_label); + + return (0); +} + +static int mac_test_check_socket_accept(struct ucred *cred, struct socket *socket, struct label *socketlabel) { @@ -2506,6 +2516,7 @@ static struct mac_policy_ops mac_test_ops = .mpo_check_proc_setresuid = mac_test_check_proc_setresuid, .mpo_check_proc_setresgid = mac_test_check_proc_setresgid, .mpo_check_proc_signal = mac_test_check_proc_signal, + .mpo_check_proc_wait = mac_test_check_proc_wait, .mpo_check_socket_accept = mac_test_check_socket_accept, .mpo_check_socket_bind = mac_test_check_socket_bind, .mpo_check_socket_connect = mac_test_check_socket_connect, diff --git a/sys/sys/mac.h b/sys/sys/mac.h index f72733d..8e5037a 100644 --- a/sys/sys/mac.h +++ b/sys/sys/mac.h @@ -351,6 +351,7 @@ int mac_check_proc_setresgid(struct proc *proc, struct ucred *cred, gid_t rgid, gid_t egid, gid_t sgid); int mac_check_proc_signal(struct ucred *cred, struct proc *proc, int signum); +int mac_check_proc_wait(struct ucred *cred, struct proc *proc); int mac_check_socket_accept(struct ucred *cred, struct socket *so); int mac_check_socket_bind(struct ucred *cred, struct socket *so, struct sockaddr *sockaddr); diff --git a/sys/sys/mac_policy.h b/sys/sys/mac_policy.h index 402d622..e519cb3 100644 --- a/sys/sys/mac_policy.h +++ b/sys/sys/mac_policy.h @@ -424,6 +424,8 @@ struct mac_policy_ops { gid_t egid, gid_t sgid); int (*mpo_check_proc_signal)(struct ucred *cred, struct proc *proc, int signum); + int (*mpo_check_proc_wait)(struct ucred *cred, + struct proc *proc); int (*mpo_check_socket_accept)(struct ucred *cred, struct socket *so, struct label *socketlabel); int (*mpo_check_socket_bind)(struct ucred *cred, diff --git a/sys/sys/proc.h b/sys/sys/proc.h index 1af6b71..7a151bb 100644 --- a/sys/sys/proc.h +++ b/sys/sys/proc.h @@ -851,6 +851,7 @@ int p_candebug(struct thread *td, struct proc *p); int p_cansee(struct thread *td, struct proc *p); int p_cansched(struct thread *td, struct proc *p); int p_cansignal(struct thread *td, struct proc *p, int signum); +int p_canwait(struct thread *td, struct proc *p); struct pargs *pargs_alloc(int len); void pargs_drop(struct pargs *pa); void pargs_free(struct pargs *pa); |
