From owner-p4-projects@FreeBSD.ORG Tue Oct 18 16:32:26 2005 Return-Path: X-Original-To: p4-projects@freebsd.org Delivered-To: p4-projects@freebsd.org Received: by hub.freebsd.org (Postfix, from userid 32767) id B6D1016A44E; Tue, 18 Oct 2005 16:32:24 +0000 (GMT) X-Original-To: perforce@freebsd.org Delivered-To: perforce@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 1F08E16A422; Tue, 18 Oct 2005 16:32:24 +0000 (GMT) (envelope-from jhb@freebsd.org) Received: from mv.twc.weather.com (mv.twc.weather.com [65.212.71.225]) by mx1.FreeBSD.org (Postfix) with ESMTP id 61BAB43D48; Tue, 18 Oct 2005 16:32:22 +0000 (GMT) (envelope-from jhb@freebsd.org) Received: from [10.50.41.234] (Not Verified[10.50.41.234]) by mv.twc.weather.com with NetIQ MailMarshal (v6, 0, 3, 8) id ; Tue, 18 Oct 2005 12:48:53 -0400 From: John Baldwin To: Robert Watson Date: Tue, 18 Oct 2005 12:21:05 -0400 User-Agent: KMail/1.8.2 References: <200510171542.j9HFgRhI073994@repoman.freebsd.org> <200510171538.30876.jhb@freebsd.org> <20051018112150.S56080@fledge.watson.org> In-Reply-To: <20051018112150.S56080@fledge.watson.org> MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit Content-Disposition: inline Message-Id: <200510181221.06529.jhb@freebsd.org> Cc: Perforce Change Reviews Subject: Re: PERFORCE change 85448 for review X-BeenThere: p4-projects@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: p4 projects tree changes List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 18 Oct 2005 16:32:26 -0000 On Tuesday 18 October 2005 06:23 am, Robert Watson wrote: > On Mon, 17 Oct 2005, John Baldwin wrote: > > On Monday 17 October 2005 11:42 am, Robert Watson wrote: > >> http://perforce.freebsd.org/chv.cgi?CH=85448 > >> > >> Change 85448 by rwatson@rwatson_zoo on 2005/10/17 15:41:26 > >> > >> In execve(), audit the path name being executed. Annotate that it > >> would also be good to audit the pathname of the interpreter, if > >> any. > > > > It's not a huge deal to do that you know, add the AUDITVNPATH1 flag to > > the various name lookups in imgact_foo.c > > I'm not sure I fully understand how the lookups are managed in execve() -- > if you look at the do_execve() code, you'll see that it iterates around > and re-executes the same namei() for the interpreter label -- however, > when I instrument it so that a second invocation audits as the second > audit path, no second path appears, suggesting that in fact it is in the > image activator. I'll have to do some more reading. I think it depends on the activator. I think that imgact_shell might depend on the second lookup in do_execve() for #!/bin/sh type files for example, but imgact_elf certainly does its own lookup to find the appopriate ELF interpreter (i.e. rtld) to use. > Robert N M Watson > > >> Affected files ... > >> > >> .. //depot/projects/trustedbsd/audit3/sys/kern/kern_exec.c#5 edit > >> > >> Differences ... > >> > >> ==== //depot/projects/trustedbsd/audit3/sys/kern/kern_exec.c#5 (text+ko) > >> ==== > >> > >> @@ -350,10 +350,13 @@ > >> /* > >> * Translate the file name. namei() returns a vnode pointer > >> * in ni_vp amoung other things. > >> + * > >> + * XXXAUDIT: It would be desirable to also audit the name of the > >> + * interpreter if this is an interpreted binary. > >> */ > >> ndp = &nd; > >> - NDINIT(ndp, LOOKUP, ISOPEN | LOCKLEAF | FOLLOW | SAVENAME | MPSAFE, > >> - UIO_SYSSPACE, args->fname, td); > >> + NDINIT(ndp, LOOKUP, ISOPEN | LOCKLEAF | FOLLOW | SAVENAME | MPSAFE | > >> + AUDITVNPATH1, UIO_SYSSPACE, args->fname, td); > >> > >> interpret: > >> error = namei(ndp); -- John Baldwin <>< http://www.FreeBSD.org/~jhb/ "Power Users Use the Power to Serve" = http://www.FreeBSD.org