summaryrefslogtreecommitdiff
path: root/libexec
AgeCommit message (Collapse)Author
2020-10-16Use the retguard macros from asm.h to protect the system call stubs.Theo de Raadt
ok mortimer kettenis
2020-10-15make three mib[] arrays const, as was done in libcTheo de Raadt
2020-10-11Don't skip file systems just because the parent fs is nodev and nosuid.Todd C. Miller
Fixes instances where a mount point uses the nodev and nosuid options but another file system mounted inside that hierarchy does not. OK schwarze@
2020-09-17afs, nnpfs, and procfs are no longer supported,Ingo Schwarze
so stop looking for them in mount(8) output; no functional change intended; OK millert@
2020-09-14Do not bother scanning file systems that are both nodev and nosuidIngo Schwarze
for SUID, SGID, and device files, implementing an idea that deraadt@ came up with based on a somewhat similar idea from millert@ after a loosely related comment from Rupert Gallagher on misc@. While here, minimally simplify the way mount options are parsed, hoping to make the parsing more readable and also more robust. OK millert@ deraadt@
2020-09-14No need to check for NULL before calling free.Martijn van Duren
from miod@
2020-09-12Documentation fixes by jmc.Martijn van Duren
2020-09-12Import login_ldap.Martijn van Duren
The code is based login_ldap port, but uses our own aldap implementation instead of openldap. It also uses a stand alone configuration file instead of login.conf, since setting this up might contain information not destined for everyone to see. OK bluhm@ "Go for it" deraadt@
2020-09-06Move definiton of struct token_types *tt to init.c from header file.mortimer
Makes it build with -fno-common. ok deraadt
2020-08-11clang 10 now emits calls to __multi3 from libcompiler_rtJeremie Courreges-Anglas
Hints from kettenis@, ok kettenis@ deraadt@
2020-07-18Use the same names as the 64-bit PowerPC ELF ABI for the relocations.Mark Kettenis
2020-07-16Rewrite loop to match what is written down in the ABI document.Mark Kettenis
ok drahn@
2020-07-16Make lazy binding work.Mark Kettenis
Committing on behalf of drahn@ who is a bit busy.
2020-07-08Clarify man pagejob
OK sobrado@ jmc@
2020-06-28Disable powerpc64 lazy binding, code was not for 64 bit ABIDale Rahn
DT_PPC_GOT is not used on powerpc64, delete.
2020-06-28Powerpc64 ld.so asm code needs to conform to Powerpc64 abi, not 32bit.Dale Rahn
ok kettenis@
2020-06-25PowerPC64 ld.so code.Dale Rahn
Mostly ported, code runs far enough to start first symbol string lookup. build with -gdwarf-4 to remove asm warnings. Do not bother supporting 32 bit non-pic relocations in shared libraries. (however leave the code there for now)
2020-05-27Remove support for world-writable mail spools.Todd C. Miller
They won't work any more due to pledge restrictions so just print an error and exit if the spool is world-writable. OK beck@
2020-05-15Fix handling of passwd entries with an empty password.Todd C. Miller
Initialize "pass" to the empty string instead of NULL, otherwise crypt_checkpass() will dereference NULL. From Yuichiro Naito via yasuoka@. OK deraadt@
2020-05-08ld.so(1) also ignores LD_LIBRARY_PATH an friends for set-group-ID executablesJeremie Courreges-Anglas
While here, use consistent casing and don't use .Ev for set-user-ID/set-group-ID. from Miod
2020-05-08LD_DEBUG is ignored for set-user-ID and set-group-ID executablesJeremie Courreges-Anglas
from Miod
2020-03-27Add missing space in stack smash handler error message.Matthieu Herrb
ok kettenis@, deraadt@
2020-03-13Anthony Steinhauser reports that 32-bit arm cpus have the same speculationTheo de Raadt
problems as 64-bit models. To resolve the syscall speculation, as a first step "nop; nop" was added after all occurances of the syscall ("swi 0") instruction. Then the kernel was changed to jump over the 2 extra instructions. In this final step, those pair of nops are converted into the speculation-blocking sequence ("dsb nsh; isb"). Don't try to build through these multiple steps, use a snapshot instead. Packages matching the new ABI will be out in a while... ok kettenis
2020-03-13Anthony Steinhauser reports that 32-bit arm cpus have the same speculationTheo de Raadt
problems as 64-bit models. For the syscall instruction issue, add nop;nop after swi 0, in preparation for jumping over a speculation barrier here later. (a lonely swi 0 was hiding in __asm in this file)
2020-03-11Anthony Steinhauser reports that 32-bit arm cpus have the same speculationTheo de Raadt
problems as 64-bit models. For the syscall instruction issue, add nop;nop after swi 0, in preparation for jumping over a speculation barrier here later. ok kettenis
2020-03-04Avoid passing a NULL name to retrieve(), use "." instead.Todd C. Miller
Fixes a "vfprintf %s NULL" warning in ftpd. OK deraadt@ tb@
2020-02-18Now that the kernel skips the two instructions immediately followingMark Kettenis
a syscall, replace the double nop with a dsb nsh; isb; sequence which stops the CPU from speculating any further. This fix was suggested by Anthony Steinhauser. ok deraadt@
2020-02-09Use sysexits.h exit values to distinguish between tempfail and permfail.Todd C. Miller
Unix MTAs use the exit value of the MDA (here mail.local) to determine whether or not a failure to deliver mail should be considered to be a temporary or permanent failure. OK semarie@ beck@
2020-02-08correct Research Unix edition "appeared in" use in HISTORYJonathan Gray
Starting from "Combined Table of Contents" in Doug McIlroy's "A Research UNIX Reader" a table of which edition manuals appeared in. Checked against manuals from bitsavers/TUHS and source from TUHS where available. Ingo points out there are cases where something is included but not documented until a later release. bcd(6) v6 v7 printf(3) v2 v4 abort(3) v5 v6 system(3) v6 v7 fmod(3) v5 v6 ok schwarze@
2020-02-07Remove backward compatibility for obsolete -H flag.Todd C. Miller
The -H flag was deprecated in 1998. OK jung@
2020-02-02Allow mail.local to be run as non-root.Todd C. Miller
If mail.local is invoked by a non-root user, open a pipe to lockspool(1) for file locking. It is only possible to delivery to a pre-existing mail spool when running mail.local as non-root. OK gilles@ deraadt@
2020-01-26Insert two nop instructions after each svc #0 instruction in userland.Mark Kettenis
The will be replaced by a speculation barrier as soon as we teach the kernel to skip over these two instructions when returning from a system call. ok patrick@, deraadt@
2020-01-15Simplify globbing of ftpd(8)s list and nlst commands.jan
Also avoid command option injection for ls(1). OK martijn@
2019-12-24Merge two missed fixes from login.c to login_passwd.c.Todd C. Miller
- use the correct length when checking for "-v lastchance=yes" - don't try to zero pass if it is NULL From miod@
2019-12-21Replace modular version with origin BSDi version with our updates.Todd C. Miller
In 2001 login_passwd was made modular so we could use the same source for passwd and kerberos auth. Now that we no longer have kerberos integrated we can simplify login_passwd. OK deraadt@
2019-12-17Eliminate failure returns from _dl_split_path(): if malloc fails just _dl_oom()Philip Guenther
Prompted by Qualys's leveraging malloc failure in _dl_split_path() to get stuff past. ok deraadt@ millert@
2019-12-17Don't look up env variables until we know we'll trust them. Otherwise,Philip Guenther
just delete them without looking. ok millert@
2019-12-14Return BI_SILENT not BI_AUTH if the challenge service is requested.Todd C. Miller
This bug was introduced in the login_passwd rewrite back in 2001. From Tom Longshine.
2019-12-11ld.so may fail to remove the LD_LIBRARY_PATH environment variable forTodd C. Miller
set-user-ID and set-group-ID executables in low memory conditions. Reported by Qualys
2019-12-09When loading a library, mmap(2) may fail. Then everything getsAlexander Bluhm
unmapped and ld.so tries again with different random address layout. In this case, use the new libc executable address for msyscall(2), not one from the first try. Fixes sporadic bogus syscall on i386. OK deraadt@
2019-12-09print addresses upon msyscall failure, for nowTheo de Raadt
2019-12-07Disable ltrace for objects linked with -znow, as at least on amd64, linkingPhilip Guenther
that was deletes the lazy relocation trampoline which ltrace currently depends on problem reported by tb@ directional feedback kettenis@ ok mpi@
2019-12-02It is not always clear what ld.so was backed up to ld.so.backup, andTheo de Raadt
better that folk doing development in here use their own cp tooling.
2019-11-30Sigh, fix i386 msyscall() case to permission the correct address range.Theo de Raadt
2019-11-29As additional paranoia, make a copy of system ld.so into obj/ld.so.backupTheo de Raadt
We don't want to CLEANFILES this one. On occasion this comes in useful.
2019-11-29Repurpose the "syscalls must be on a writeable page" mechanism toTheo de Raadt
enforce a new policy: system calls must be in pre-registered regions. We have discussed more strict checks than this, but none satisfy the cost/benefit based upon our understanding of attack methods, anyways let's see what the next iteration looks like. This is intended to harden (translation: attackers must put extra effort into attacking) against a mixture of W^X failures and JIT bugs which allow syscall misinterpretation, especially in environments with polymorphic-instruction/variable-sized instructions. It fits in a bit with libc/libcrypto/ld.so random relink on boot and no-restart-at-crash behaviour, particularily for remote problems. Less effective once on-host since someone the libraries can be read. For static-executables the kernel registers the main program's PIE-mapped exec section valid, as well as the randomly-placed sigtramp page. For dynamic executables ELF ld.so's exec segment is also labelled valid; ld.so then has enough information to register libc's exec section as valid via call-once msyscall(2) For dynamic binaries, we continue to to permit the main program exec segment because "go" (and potentially a few other applications) have embedded system calls in the main program. Hopefully at least go gets fixed soon. We declare the concept of embedded syscalls a bad idea for numerous reasons, as we notice the ecosystem has many of static-syscall-in-base-binary which are dynamically linked against libraries which in turn use libc, which contains another set of syscall stubs. We've been concerned about adding even one additional syscall entry point... but go's approach tends to double the entry-point attack surface. This was started at a nano-hackathon in Bob Beck's basement 2 weeks ago during a long discussion with mortimer trying to hide from the SSL scream-conversations, and finished in more comfortable circumstances next to a wood-stove at Elk Lakes cabin with UVM scream-conversations. ok guenther kettenis mortimer, lots of feedback from others conversations about go with jsing tb sthen
2019-11-28Unrevert: this change was unrelatedPhilip Guenther
2019-11-28Revert yesterday's _dl_md_reloc() and _dl_md_reloc_got() changes:Philip Guenther
something's broken on at least i386.
2019-11-27Delete now obsolete commentsPhilip Guenther
2019-11-27unifdef: hppa does HAVE_JMPREL and does not have DT_PROCNUMPhilip Guenther
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-26 02:21:27 +0000