Date: Wed, 3 Jul 2013 22:16:02 +0000 (UTC) From: Pawel Jakub Dawidek <pjd@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r252628 - head/sbin/dhclient Message-ID: <201307032216.r63MG24I038434@svn.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: pjd Date: Wed Jul 3 22:16:02 2013 New Revision: 252628 URL: http://svnweb.freebsd.org/changeset/base/252628 Log: MFp4 @229482: - Limit bpf descriptor in unprivileged process to CAP_POLL_EVENT, CAP_READ and allow for SIOCGIFFLAGS, SIOCGIFMEDIA ioctls. - While here limit bpf descriptor in privileged process to only CAP_WRITE. Reviewed by: brooks Sponsored by: The FreeBSD Foundation Modified: head/sbin/dhclient/bpf.c Modified: head/sbin/dhclient/bpf.c ============================================================================== --- head/sbin/dhclient/bpf.c Wed Jul 3 22:14:12 2013 (r252627) +++ head/sbin/dhclient/bpf.c Wed Jul 3 22:16:02 2013 (r252628) @@ -45,6 +45,7 @@ __FBSDID("$FreeBSD$"); #include "dhcpd.h" #include "privsep.h" +#include <sys/capability.h> #include <sys/ioctl.h> #include <sys/uio.h> @@ -159,6 +160,9 @@ if_register_send(struct interface_info * if (ioctl(info->wfdesc, BIOCLOCK, NULL) < 0) error("Cannot lock bpf"); + if (cap_rights_limit(info->wfdesc, CAP_WRITE) < 0 && errno != ENOSYS) + error("Can't limit bpf descriptor: %m"); + /* * Use raw socket for unicast send. */ @@ -208,6 +212,7 @@ int dhcp_bpf_filter_len = sizeof(dhcp_bp void if_register_receive(struct interface_info *info) { + static const unsigned long cmds[2] = { SIOCGIFFLAGS, SIOCGIFMEDIA }; struct bpf_version v; struct bpf_program p; int flag = 1, sz; @@ -258,6 +263,13 @@ if_register_receive(struct interface_inf if (ioctl(info->rfdesc, BIOCLOCK, NULL) < 0) error("Cannot lock bpf"); + + if (cap_rights_limit(info->rfdesc, + CAP_IOCTL | CAP_POLL_EVENT | CAP_READ) < 0 && errno != ENOSYS) { + error("Can't limit bpf descriptor: %m"); + } + if (cap_ioctls_limit(info->rfdesc, cmds, 2) < 0 && errno != ENOSYS) + error("Can't limit ioctls for bpf descriptor: %m"); } void
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201307032216.r63MG24I038434>