summaryrefslogtreecommitdiff
path: root/bin
diff options
context:
space:
mode:
Diffstat (limited to 'bin')
-rw-r--r--bin/systrace/intercept.c31
-rw-r--r--bin/systrace/intercept.h13
-rw-r--r--bin/systrace/parse.y6
-rw-r--r--bin/systrace/systrace.135
-rw-r--r--bin/systrace/systrace.c9
-rw-r--r--bin/systrace/systrace.h3
6 files changed, 81 insertions, 16 deletions
diff --git a/bin/systrace/intercept.c b/bin/systrace/intercept.c
index 44c2accf41e..4dcfb126a39 100644
--- a/bin/systrace/intercept.c
+++ b/bin/systrace/intercept.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: intercept.c,v 1.15 2002/07/12 12:26:29 provos Exp $ */
+/* $OpenBSD: intercept.c,v 1.16 2002/07/16 01:22:48 provos Exp $ */
/*
* Copyright 2002 Niels Provos <provos@citi.umich.edu>
* All rights reserved.
@@ -223,6 +223,7 @@ sigusr1_handler(int signum)
pid_t
intercept_run(int bg, int fd, char *path, char *const argv[])
{
+ struct intercept_pid *icpid;
sigset_t none, set, oset;
sig_t ohandler;
pid_t pid, cpid;
@@ -283,6 +284,14 @@ intercept_run(int bg, int fd, char *path, char *const argv[])
/* Choose the pid of the systraced process */
pid = bg ? pid : cpid;
+ if ((icpid = intercept_getpid(pid)) == NULL)
+ err(1, "intercept_getpid");
+
+ /* Set uid and gid information */
+ icpid->uid = getuid();
+ icpid->gid = getgid();
+ icpid->flags |= ICFLAGS_UIDKNOWN | ICFLAGS_GIDKNOWN;
+
/* Setup done, restore signal handling state */
if (signal(SIGUSR1, ohandler) == SIG_ERR) {
kill(pid, SIGKILL);
@@ -568,6 +577,8 @@ intercept_syscall(int fd, pid_t pid, int policynr, char *name, int code,
/* We need to know the result from this system call */
flags = ICFLAGS_RESULT;
+ } else if (!strcmp(name, "setuid") || !strcmp(name, "setgid")) {
+ flags = ICFLAGS_RESULT;
}
sc = intercept_sccb_find(emulation, name);
@@ -602,12 +613,13 @@ intercept_syscall_result(int fd, pid_t pid, int policynr,
{
struct intercept_pid *icpid;
+ if (result)
+ goto out;
+
+ icpid = intercept_getpid(pid);
if (!strcmp("execve", name)) {
- if (result)
- goto out;
/* Commit the name of the new image */
- icpid = intercept_getpid(pid);
if (icpid->name)
free(icpid->name);
icpid->name = icpid->newname;
@@ -617,6 +629,12 @@ intercept_syscall_result(int fd, pid_t pid, int policynr,
(*intercept_newimagecb)(fd, pid, policynr, emulation,
icpid->name, intercept_newimagecbarg);
+ } else if (!strcmp("setuid", name)) {
+ intercept.getarg(0, args, argsize, (void **)&icpid->uid);
+ icpid->flags |= ICFLAGS_UIDKNOWN;
+ } else if (!strcmp("setgid", name)) {
+ intercept.getarg(0, args, argsize, (void **)&icpid->gid);
+ icpid->flags |= ICFLAGS_GIDKNOWN;
}
out:
/* Resume execution of the process */
@@ -677,6 +695,11 @@ intercept_child_info(pid_t opid, pid_t npid)
err(1, "%s:%d: strdup", __func__, __LINE__);
}
+ /* Copy some information */
+ inpid->flags = ipid->flags;
+ inpid->uid = ipid->uid;
+ inpid->gid = ipid->gid;
+
/* XXX - keeps track of emulation */
intercept.clonepid(ipid, inpid);
}
diff --git a/bin/systrace/intercept.h b/bin/systrace/intercept.h
index 137ba307c9d..2c1fb96421b 100644
--- a/bin/systrace/intercept.h
+++ b/bin/systrace/intercept.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: intercept.h,v 1.6 2002/07/12 12:26:29 provos Exp $ */
+/* $OpenBSD: intercept.h,v 1.7 2002/07/16 01:22:48 provos Exp $ */
/*
* Copyright 2002 Niels Provos <provos@citi.umich.edu>
* All rights reserved.
@@ -75,8 +75,15 @@ struct intercept_pid {
short policynr;
int execve_code;
short execve_policy;
- char *name;
- char *newname;
+ char *name; /* name of current process image */
+ char *newname; /* image name to be committed by execve */
+
+#define ICFLAGS_UIDKNOWN 0x01
+#define ICFLAGS_GIDKNOWN 0x02
+ int flags;
+
+ uid_t uid; /* current uid */
+ gid_t gid; /* current gid */
void *data;
diff --git a/bin/systrace/parse.y b/bin/systrace/parse.y
index d95d47f490d..a7bb313dce6 100644
--- a/bin/systrace/parse.y
+++ b/bin/systrace/parse.y
@@ -1,4 +1,4 @@
-/* $OpenBSD: parse.y,v 1.4 2002/06/05 17:22:38 mickey Exp $ */
+/* $OpenBSD: parse.y,v 1.5 2002/07/16 01:22:48 provos Exp $ */
/*
* Copyright 2002 Niels Provos <provos@citi.umich.edu>
@@ -103,6 +103,10 @@ fullexpression : expression THEN action errorcode
break;
if (!strcasecmp($4, "inherit"))
flags = PROCESS_INHERIT_POLICY;
+ else if (!strcasecmp($4, "detach"))
+ flags = PROCESS_DETACH;
+ else
+ yyerror("Unknown flag: %s", $4);
break;
}
diff --git a/bin/systrace/systrace.1 b/bin/systrace/systrace.1
index e28abe64c31..741a8e812c0 100644
--- a/bin/systrace/systrace.1
+++ b/bin/systrace/systrace.1
@@ -1,4 +1,4 @@
-.\" $OpenBSD: systrace.1,v 1.21 2002/07/09 15:22:27 provos Exp $
+.\" $OpenBSD: systrace.1,v 1.22 2002/07/16 01:22:48 provos Exp $
.\"
.\" Copyright 2002 Niels Provos <provos@citi.umich.edu>
.\" All rights reserved.
@@ -63,7 +63,15 @@ Automatically generate a policy that allows every operation the
application executes.
The created policy functions as a base that can be refined.
.It Fl u
-Do not perform aliasing on system call names.
+Do not perform aliasing on system call names. Aliasing is enabled
+by default to group similar system calls into a single compound
+name. For example, system calls that read from the file system
+like
+.Fn lstat
+and
+.Fn access
+are translated to
+.Fn fsread .
.It Fl i
Inherits the policy of the first executed binary to all children.
.It Fl t
@@ -110,16 +118,33 @@ is used to return an
.Xr errno 2
value to the system call when using a
.Va deny
-action. The value
+action. The values
.Do
inherit
.Dc
-has a special meaning when used with a
+and
+.Do
+detach
+.Dc
+have special meanings when used with a
.Va permit
rule for the
.Va execve
system call.
-In that case, the current policy is inherited for the new binary.
+When using
+.Do
+inherit,
+.Dc
+the current policy is inherited for the new binary.
+With
+.Do
+detach,
+.Dc
+systrace detaches from a process after successfully
+completing
+the
+.Va execve
+system call.
.Pp
The filter operations have the following meaning:
.Bl -hang -width Dinpath -offset AAA
diff --git a/bin/systrace/systrace.c b/bin/systrace/systrace.c
index cd0b4830a40..a6610531283 100644
--- a/bin/systrace/systrace.c
+++ b/bin/systrace/systrace.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: systrace.c,v 1.26 2002/07/12 12:26:29 provos Exp $ */
+/* $OpenBSD: systrace.c,v 1.27 2002/07/16 01:22:48 provos Exp $ */
/*
* Copyright 2002 Niels Provos <provos@citi.umich.edu>
* All rights reserved.
@@ -254,10 +254,15 @@ execres_cb(int fd, pid_t pid, int policynr, char *emulation, char *name, void *a
if (policynr != -1) {
struct intercept_pid *ipid;
+ ipid = intercept_getpid(pid);
+ if (ipid->uflags & PROCESS_DETACH) {
+ if (intercept_detach(fd, pid) == -1)
+ err(1, "%s: intercept_detach", __func__);
+ return;
+ }
if (inherit)
return;
- ipid = intercept_getpid(pid);
if (ipid->uflags & PROCESS_INHERIT_POLICY)
return;
}
diff --git a/bin/systrace/systrace.h b/bin/systrace/systrace.h
index 423af432b11..b4ed66f0519 100644
--- a/bin/systrace/systrace.h
+++ b/bin/systrace/systrace.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: systrace.h,v 1.9 2002/07/14 22:34:55 provos Exp $ */
+/* $OpenBSD: systrace.h,v 1.10 2002/07/16 01:22:48 provos Exp $ */
/*
* Copyright 2002 Niels Provos <provos@citi.umich.edu>
* All rights reserved.
@@ -97,6 +97,7 @@ struct policy {
#define POLICY_CHANGED 0x04
#define PROCESS_INHERIT_POLICY 0x01 /* Process inherits policy */
+#define PROCESS_DETACH 0x02 /* Process gets detached */
int systrace_initpolicy(char *);
void systrace_initcb(void);