summaryrefslogtreecommitdiff
path: root/sys/kern/kern_unveil.c
AgeCommit message (Collapse)Author
2022-12-05zap a pile of dangling tabsTheo de Raadt
2022-08-14remove unneeded includes in sys/kernJonathan Gray
ok mpi@ miod@
2022-01-11move kern_unveil.c to use DPRINTF()Sebastien Marie
Changes the way printf debug is done in kern_unveil.c Currently, each printf() is enclosed in #ifdef DEBUG_UNVEIL. It moves to using DPRINTF(), and reduces the number of #ifdef inside the file. Also changes some strings to use __func__ instead of using the function name verbatim. ok visa@
2022-01-09Add an UNVEIL_USERSET flag which is set when a unveil node is added viaClaudio Jeker
unveil(2). It is not set for nodes that are added as a result of a file being added via unveil(2). Use this flag to test if backtracking should be done or not. Also introduce UNVEIL_MASK which checks if any user flags are set and is used to properly return EACCES vs ENOENT. This fixes a problem where unveil("/", "r") & unveil("/usr/bin/id", "rx") cause an error when read accessing "/usr/bin". It also makes sure that unveil(path, "") will return ENOENT for any access of anything under path. Reported by and OK semarie@
2021-09-09No need to initialize nuv, it is assigned to before use.Claudio Jeker
2021-09-02Refactor how unveil generates EACCES errors. Instead of tracking theClaudio Jeker
possible violation during the traversal of the path do the check at the end. Make the code a bit easier to grok. OK beck@ semarie@
2021-08-30Make sure unveil remains locked over fork even in the case where theClaudio Jeker
parent just called unveil(NULL, NULL) and nothing else. With and OK beck@
2021-07-16Remove the unveil current directory pointer from struct process. InsteadClaudio Jeker
pass in the vnode to unveil_start_relative() like it is done for *at() syscalls. This fixes an issue with fchdir() that actually did not correctly reset this pointer when changing the working directory. OK beck@
2021-07-15UNVEIL_INSPECT is no longer needed, adjust code accordingly.Claudio Jeker
OK semarie@
2021-07-08Remove the code to store intermediary vnodes in the unveil list.Claudio Jeker
These traversed vnodes are a leftover from early times where realpath(3) was still all done in userland. OK semarie@
2021-06-29Adjust unveil_find_cover() to return -1 if the root vnode is passed in.Claudio Jeker
This helps unveil_add_vnode() to properly re-evaluate unveils when "/" is added to the list. Because of this adjust unveil_covered() to check for the root as well so that in that case the unveil uv is returned instead of NULL. Traversing up from the root returns the root. This check is not really needed since namei has its own root check and shortcuts for root vnodes. OK semarie@
2021-06-24unveil: cleanup code. no intented functional change.Sebastien Marie
return early for simple conditions instead of using navigating inside if-branches. with and ok claudio@
2021-06-23In unveil_add_vnode() refactor code around the indexes i and j. In oneClaudio Jeker
place the wrong index is used resulting in re-evaluating all unveil nodes. Also loop over over all but the last (just added vnode) -- again there is no need to re-evaluate the cover of the just added unveil. OK anton@ semarie@
2021-06-15Remove the uvshrink logic and keep the unveil list in the order of insertion.Claudio Jeker
unveil_lookup() is now doing a dumb linear search. The problem with the uvshrink logic was that ps_uvpcwd was a pointer into this array and after compation it pointed to the wrong element. Also future unveil caches would suffer from the same issue. OK semarie@
2021-06-09unveil: small cleanup for UNVEIL_INSPECTSebastien Marie
remove two leftover checks which were used when ni_unveil was used with UNVEIL_INSPECT. it was used by: - readlink(2) - removed 2019-08-31 - stat(2) and access(2) - removed 2019-03-24 ok claudio@
2021-03-10spellingJonathan Gray
ok gnezdo@ semarie@ mpi@
2020-03-22remove unused variable; ok beck@ mpi@anton
2020-03-19Separate variable declaration and assignment. No functional change.anton
Requested by mpi@
2020-03-19Move unveil data structures away from the proc.h header into theanton
implementation file. Pushing the assignment of ps_uvpcwd down to unveil_add() is required but it doesn't introduce any functional change. ok mpi@ semarie@
2020-01-22delete wasteful ;;Theo de Raadt
ok tedu
2019-11-29Eliminate the sketchy use of ps_mainproc here by making unveil_add_vnode()Philip Guenther
take a struct proc* instead of a struct process*, and vice versa making unveil_lookup() take a process* instead of a proc*. ok beck@
2019-10-01Only increment the ps_uvncount counter when a path is successfully addedanton
to the corresponding red-black tree; meaning the path was not already present in the tree. This prevents an assertion to trigger in unveil_destroy() later on when the process exits. ok beck@ Reported-by: syzbot+db66362e1ffdc72e5aeb@syzkaller.appspotmail.com
2019-09-11Fix unveil for relative lookups in the non AT_FDCWD caseBob Beck
Issue spotted by Benjamin Baier <programmer@netzbasis.de> with relative path lookups from openat(2). Lacking a current working directory unveil, operations using the *at functions could fail when not crossing an unveil, since an initial covering unveil was not found. This corrects this so we walk up from the directory vnode to find a covering unveil at the start of non AT_FDCWD lookups, and adds regress for this case. ok bluhm@
2019-08-05Remove the unused function parameter rootvnode from unveil_add_vnode().Alexander Bluhm
2019-08-02Move prototypes of unveil(2) functions which are used in separate CAlexander Bluhm
files into the common namei.h header. OK deraadt@
2019-08-01In ufs_lookup() *vpp is always refcounted, also in the ISDOTDOTAlexander Bluhm
case even if *vpp == vdp. So in unveil_find_cover() it is wrong to skip dereferencing if parent == vp. This fixes an umount(8) device busy error when unveil(2) and chroot(2) are used together on a file system. reported by Matthias Pitzl; OK deraadt@
2019-07-29correct mispellings of EACCES; from Kris KatterjohnTheo de Raadt
2019-07-25Use process accounting to find programs which try to access filesAlexander Bluhm
that are hidden by unveil(2). OK deraadt@
2019-07-14Don't lock the struct unveil being created in the child when cloning thePhilip Guenther
parent's during fork() witness reports from ajacoutot@ and Hrvoje Popovski (hrvoje (at) srce.hr) ok visa@
2019-06-19the pledge STATLIE code is no longer needed, as discussed with beck.Theo de Raadt
it actually isn't reached...
2019-03-26Remove this assert, I can't do this here with UNVEIL_INSPECTBob Beck
added aggressively today. Hopefully post release a glorious flensing will remove UNVEIL_INSPECT anyway Reported-by: syzbot+3375ce307ac7909b907b@syzkaller.appspotmail.com
2019-03-24Make stat(2) and access(2) need UNVEIL_READ instead of UNVEIL_INSPECTBob Beck
UNVEIL_INSPECT is a hack we added to get chrome/glib working. It silently adds permission for stat(2), access(2), and readlink(2) to be used on all path components of any unveil'ed path. robert@ has sucessfully now fixed chrome/glib to not require exessive TOC vs TOU stat(2) and access(2) calls on the paths it uses, so that this no longer needed there. readlink(2) is the sole call that is now permitted by UNVEIL_INSPECT, and this is only needed so that realpath(3) can work. Going forward we will likely make a realpath(2), after which we can completely deprecate UNVEIL_INSPECT. ok deraadt@
2019-01-21sometimes we don't call unveil_add, which means memory allocated by nameiTed Unangst
doesn't get freed. move the free calls into the same function as namei. fixed bug report from Dariusz Sendkowski ok beck
2019-01-17Unveil fixes:Bob Beck
1) Correctly notice covering unveil when using .. - fix crash noticed by visa@ 2) Notice when v_mount is NULL to not crash when unveil vnodes are on a forcibly unmounted filesystem, noticed by yasuoka@ 3) Add a flag to ni_data so that failures from unveil flag mismatches in covering unveils return the correct EACCESS instead of ENOENT (noticed by brynet@) ok deraadt@
2019-01-14backout previous; crashes near mountpoints it seemsTheo de Raadt
2019-01-14Fix unveil issue noticed by kn@ where unveil does not notice coveringBob Beck
unveil matches when .. is used correctly. Also adds regress based upon his test program for the same issue.
2019-01-06Clear ps_uvpcwd when we free ps_uvpaths. Fixes a crash seen by kn@ and meMark Kettenis
where ps_uvpcwd obviously contains a dangling pointer. ok deraadt@, krw@
2019-01-03Fix a collection of covering unveil bugs that prevent unveil's of upperBob Beck
level directories from working when you don't traverse into them starting from /. Most found by brynet@ and a few others. ok brynet@ deraadt@
2018-10-29needs sys/lock.hTheo de Raadt
2018-10-28Correctly deal with upper level unveil's by keeping track of the coveringBob Beck
unveil for each unveil in the process at unveil() time, and refactoring the handling of current directory and ISDOTDOT to be much more sensible. Worked out at ns2k18 with guenther@. ok deraadt@
2018-09-25fix typo in commentJasper Lievisse Adriaanse
ok beck@
2018-08-28Fix stat of path components - this was breaking chrome - because theBob Beck
final directory in a name unveil was not being added with UNVEIL_INSPECT if it was not already unveiled. Now passes just added regress test for this case
2018-08-11Get rid of PLEDGE_STAT, which was a hack used for unveil.Bob Beck
We use UNVEIL_INSPECT instead in the unveil flags for the same purpose, and now add traversed vnodes of a path with UNVEIL_INSPECT instead of with 0 flags and voodoo in unveil_flagmatch. This allows us to uncontort the logic of unveil_flagmatch a bunch. helpful review and ok from semarie@
2018-08-07UNVEIL_* flags defined elsewhere in a .h fileTheo de Raadt
2018-08-05Decouple unveil from the pledge flags, by adding dedicated unveil flagsBob Beck
to the namei args. This fixes a bug where chmod would be allowed when with only READ. This also allows some further cleanup of some awkward things like PLEDGE_STAT that will follow Lots of assistence from semarie@ - thanks! ok semarie@
2018-08-05Prevent a panic when reboot -q is used by making unveil_removevnodeBob Beck
sane. ok kettenis@
2018-07-30rename 2nd argument of unveil from vague "flags" to "permissions";Theo de Raadt
man page change will follow
2018-07-30KNFTheo de Raadt
2018-07-29revert accidentally changed prototypeBob Beck
2018-07-29Don't exceed UNVEIL_MAX_VNODES with a long path now that we saveBob Beck
the traversed vnodes - noticed and fixed by semarie@
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-03 18:01:35 +0000