diff options
| author | Artur Grabowski <art@cvs.openbsd.org> | 2001-06-18 13:18:37 +0000 |
|---|---|---|
| committer | Artur Grabowski <art@cvs.openbsd.org> | 2001-06-18 13:18:37 +0000 |
| commit | b782bf60d35cf180485aa78349cef8c3e1a01216 (patch) | |
| tree | 78cfea37ec97c5f6b7928abcfb4fa1ffea50f6f0 /sys | |
| parent | c13c77c7842325e5818411ed17f4763e97a5d121 (diff) | |
Add proc_cansugid used to check if a process should be allowed
to raise its privileges in exec.
Diffstat (limited to 'sys')
| -rw-r--r-- | sys/kern/kern_prot.c | 20 | ||||
| -rw-r--r-- | sys/sys/proc.h | 4 |
2 files changed, 22 insertions, 2 deletions
diff --git a/sys/kern/kern_prot.c b/sys/kern/kern_prot.c index 38a789ffc9d..6eb98c91f4c 100644 --- a/sys/kern/kern_prot.c +++ b/sys/kern/kern_prot.c @@ -1,4 +1,4 @@ -/* $OpenBSD: kern_prot.c,v 1.14 2000/11/08 21:27:03 art Exp $ */ +/* $OpenBSD: kern_prot.c,v 1.15 2001/06/18 13:18:36 art Exp $ */ /* $NetBSD: kern_prot.c,v 1.33 1996/02/09 18:59:42 christos Exp $ */ /* @@ -53,6 +53,7 @@ #include <sys/timeb.h> #include <sys/times.h> #include <sys/malloc.h> +#include <sys/filedesc.h> #include <sys/mount.h> #include <sys/syscallargs.h> @@ -655,3 +656,20 @@ sys_setlogin(p, v, retval) error = EINVAL; return (error); } + +/* + * Check if a process is allowed to raise its privileges. + */ +int +proc_cansugid(struct proc *p) +{ + /* ptrace(2)d processes shouldn't. */ + if ((p->p_flag & P_TRACED) != 0) + return (EPERM); + + /* proceses with shared filedescriptors shouldn't. */ + if (p->p_fd->fd_refcnt > 1) + return (EPERM); + + return (0); +} diff --git a/sys/sys/proc.h b/sys/sys/proc.h index a1c719f13e5..2cfc5afdc57 100644 --- a/sys/sys/proc.h +++ b/sys/sys/proc.h @@ -1,4 +1,4 @@ -/* $OpenBSD: proc.h,v 1.40 2001/04/02 21:43:12 niklas Exp $ */ +/* $OpenBSD: proc.h,v 1.41 2001/06/18 13:18:36 art Exp $ */ /* $NetBSD: proc.h,v 1.44 1996/04/22 01:23:21 christos Exp $ */ /*- @@ -392,5 +392,7 @@ int groupmember __P((gid_t, struct ucred *)); void cpu_switch __P((struct proc *)); void cpu_wait __P((struct proc *)); void cpu_exit __P((struct proc *)); + +int proc_cansugid __P((struct proc *)); #endif /* _KERNEL */ #endif /* !_SYS_PROC_H_ */ |