summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2015-10-06fix flowsrc spec, ok florian, thx ingo!Sebastian Benoit
2015-10-06When "proc" is requested, allow setpgid() and sigsuspend().Theo de Raadt
Also the combination of "proc tty" needs to permit TIOCSPGRP. This is the start at minimum semantics required by processes which work on process groups, sessions, ttys.
2015-10-06we're running rm. call it rm too.Ted Unangst
2015-10-06update "cmsg" tests: it lost TAME_SELF flag.Sebastien Marie
2015-10-06Move from tame "cmsg" to tame "sendfd" or "recvfd", depending on whichTheo de Raadt
way the process moves fd's.
2015-10-06add some tests for rpath, wpath, cpathSebastien Marie
2015-10-06Add new "tty" request, which allows TIOCGETA, TIOCGPGRP, TIOCGWINSZ,Theo de Raadt
TIOCSBRK, TIOCCDTR, TIOCSETA, TIOCSETAW, and TIOCSETAF on tty vnodes. This helps programs which call tcsetattr(), tcgetattr(), or readpassphrase(). Especially the latter - tame's goal is to satisfy the libc requirements of security-sensitive programs. Remove TIOCSETAF from the basic "ioctl" request, because it is a "set" option. "ioctl" is slowly turning into a "request information, cannot set options" package. Split the "cmsg" request into "sendfd" and "recvfd". Non-SCM_RIGHTS messages are currently flowing through freely and we'll need to think about that. This split lets us more strictly describe what our many fd-passing programs will do.
2015-10-06Make sure that tx_buffer->next_eop is properly set before we bump the numberMark Kettenis
of available descriptors, such that the interrupt handler doesn't attempt to complete partially initialized descriptors. Seems to fix the watchdog timeouts reported by various people. Tested by Mattieu Baptiste and Gregor Best. ok mikeb@
2015-10-06Remove the -C option that converts an S/Key database to the new format. It hasTim van der Molen
been 13 years since the new format was introduced. OK millert@
2015-10-06Don't burden keycrunch_{md5,sha1,rmd160}() with identical code to prepare aTim van der Molen
buffer based on whether they are called by keycrunch() or f(). Instead let keycrunch() and f() take care of this themselves. OK millert@
2015-10-06Update path in comment; OK millert@Tim van der Molen
2015-10-06clear out some more legacy code and whatnotTed Unangst
2015-10-06Rework the tame cmsg handler to make it work both ways. While on recv oneClaudio Jeker
mbuf blob with all the cmsgs inside while on send cmsgs in an mbuf chain, one mbuf per message. Adjust the calls accordingly. Putting it in so deraadt@ can move forward.
2015-10-06rmdir() is just a CPATH operation; remove RPATH marker that snuck in.Theo de Raadt
2015-10-06Make sure that all padding bytes in cmsgs are actually zero by memsetClaudio Jeker
CMSG_SIZE(len) bytes of the mbuf.
2015-10-06oops, namei was never allowing through valid CPATH operationsTheo de Raadt
2015-10-06Add getrusage() to the TAME_SELF catagory.Theo de Raadt
2015-10-06Fix buf leak in error path. ok gilles@ eric@Stefan Sperling
2015-10-06only modifies data, stdin to stdout, so tame "stdout"Theo de Raadt
2015-10-06use tame "stdio rpath wpath cpath fattr". There is some timezoneTheo de Raadt
database stuff here which goes further than most programs, but the neccessary files are readable using "rpath".
2015-10-06simple tame "stdio rpath"Theo de Raadt
2015-10-06tame "stdio rpath" before opening the file, tame "stdio" after thatTheo de Raadt
2015-10-06prefer limits.h over sys/limits.hBrent Cook
ok deraadt@
2015-10-06Simple update for pdf, from file 5.x.Nicholas Marriott
2015-10-06Make iwm(4) set the MAC address the same way other wireless drivers do.Stefan Sperling
ok mpi@
2015-10-06we don't need this temporary buffer since we're going to strdup() it rightGilles Chehade
away anyways ok eric@
2015-10-06Another simple update for xwindows, from 5.x.Nicholas Marriott
2015-10-06Log the matched offset (and the new offset) instead of just of the newNicholas Marriott
offset (as if it was where the match was found).
2015-10-06ssh and ssl key file magic, from file 5.x.Nicholas Marriott
2015-10-06Another simple update from file 5.x.Nicholas Marriott
2015-10-06fix snprintf() error checking in token expansion code, these can't possiblyGilles Chehade
fail but it's no excuse for getting the checks wrong. spotted by qualys
2015-10-06fix chdir() call for the sake of correctnessGilles Chehade
reported by qualys
2015-10-06fix values passed to umask(), they should be octal.Gilles Chehade
the permissions are even more restrictive than they should. misc bug reported by qualys
2015-10-06do not need ioctl.hTheo de Raadt
2015-10-06Obvious tame "stdio rpath wpath cpath" to a program I will never use.Theo de Raadt
2015-10-06fix reallocarray() constructs to always use temporary variableGilles Chehade
2015-10-06Enable ioctl() in the "rw" request, to support FIONREAD/FIONBIO easierTheo de Raadt
for the stdio/libevent usage case. Further ioctl commands are narrowly checked as before. ok djm guenther semarie
2015-10-06these do not use ioctl.hTheo de Raadt
2015-10-06struct knote's kn_sdata needs to be the same type as struct kevent's dataPhilip Guenther
ok deraadt@
2015-10-06tame "stdio getpw"Theo de Raadt
discussed with guenther
2015-10-06data processing stdin to stdout; tame "stdout"Theo de Raadt
2015-10-06unfortunately tame "stdio" can only happen well after the sequence of:Theo de Raadt
utmp parsing, tty opening, setresgid to drop privs. it only protects a basic io loop. discussed with doug
2015-10-06adapt to recent sshkey_parse_private_fileblob() API changeDamien Miller
2015-10-06The performance hit for -fstack-protector-all is worth it here.Theo de Raadt
ok gilles
2015-10-06Appears that tame "stdio getpw rpath" will satisfy all code paths.Theo de Raadt
2015-10-05During getopt(), an optional file may be opened. After that, tame "stdio"Theo de Raadt
works. Time for some commentary! tame became possible because syslog(3) in openbsd uses a system call -- sendsyslog(2) -- which does not require an elaborate dance opening an AF_UNIX socket and using connect() or send() to deliver to a "/dev/log" unix socket in the filesystem. sendsyslog(2) was invented to ensure the stack-protector's __stack_smash_handler() can gaurantee delivery of failure messages to syslogd(8) in harsh conditions -- such as file descriptor exhaustion or inside chroot(2). Now it also works in tame(2)'d proceses, since sendsyslog(2) is always allowed. Our syslog(3) needs no elaborate socket code, therefore piles of software does not have an inate need for socket(2), connect(2), send(2), nor access to the filesystem. syslog(3) remains fully compatible otherwise. How does the stack protector report an error in fully capsicum'd program? Or in some other Linux protection mechanism, if someone protectes a program too far and takes sockets away, how do they see the stack protector working? You can have nice things when the underlying rules change.
2015-10-05tame "stdio rpath wpath cpath", because this program reads and createsTheo de Raadt
files, using stdio. It does nothing else.
2015-10-05Remove EXTERN from lex.h and put the definitions in lex.c, from MichaelNicholas Marriott
McConville.
2015-10-05Remove EXTERN from table.h and put the definitions in table.c, fromNicholas Marriott
Michael McConville.
2015-10-05Another trivial update, some extra bits for timezone, from file 5.x.Nicholas Marriott
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-12 10:49:14 +0000