From owner-freebsd-security  Sun Aug 10 20:16:45 1997
Return-Path: <owner-freebsd-security>
Received: (from root@localhost)
          by hub.freebsd.org (8.8.5/8.8.5) id UAA04983
          for security-outgoing; Sun, 10 Aug 1997 20:16:45 -0700 (PDT)
Received: from freefall.freebsd.org (freefall.FreeBSD.ORG [204.216.27.21])
          by hub.freebsd.org (8.8.5/8.8.5) with ESMTP id UAA04974;
          Sun, 10 Aug 1997 20:16:39 -0700 (PDT)
From: Sean Eric Fagan <sef@FreeBSD.ORG>
Received: (from sef@localhost)
	by freefall.freebsd.org (8.8.6/8.8.5) id UAA14486;
	Sun, 10 Aug 1997 20:15:52 -0700 (PDT)
Date: Sun, 10 Aug 1997 20:15:52 -0700 (PDT)
Message-Id: <199708110315.UAA14486@freefall.freebsd.org>
To: current@FreeBSD.ORG, security@FreeBSD.ORG
Subject: procfs patch
Sender: owner-freebsd-security@FreeBSD.ORG
X-Loop: FreeBSD.org
Precedence: bulk

The following patch should fix the problem with procfs.  These patches
are to -current (well, a version I just checked out about an hour
ago).  I have 2.2-GAMMA diffs as well.

Index: miscfs/procfs/procfs.h
===================================================================
RCS file: /home/ncvs/src/sys/miscfs/procfs/procfs.h,v
retrieving revision 1.15
diff -u -r1.15 procfs.h
--- procfs.h	1997/02/22 09:40:26	1.15
+++ procfs.h	1997/08/11 01:42:06
@@ -85,6 +85,18 @@
 	  (bcmp((s), (cnp)->cn_nameptr, (len)) == 0))
 
 #define KMEM_GROUP 2
+
+/*
+ * Check to see whether access to target process is allowed
+ * Evaluates to 1 if access is allowed.
+ */
+#define CHECKIO(p1, p2) \
+     ((((p1)->p_cred->pc_ucred->cr_uid == (p2)->p_cred->p_ruid) && \
+       ((p1)->p_cred->p_ruid == (p2)->p_cred->p_ruid) && \
+       ((p1)->p_cred->p_svuid == (p2)->p_cred->p_ruid) && \
+       ((p2)->p_flag & P_SUGID) == 0) || \
+      (suser((p1)->p_cred->pc_ucred, &(p1)->p_acflag) == 0))
+      
 /*
  * Format of a directory entry in /proc, ...
  * This must map onto struct dirent (see <dirent.h>)
Index: miscfs/procfs/procfs_mem.c
===================================================================
RCS file: /home/ncvs/src/sys/miscfs/procfs/procfs_mem.c,v
retrieving revision 1.26
diff -u -r1.26 procfs_mem.c
--- procfs_mem.c	1997/08/02 14:32:14	1.26
+++ procfs_mem.c	1997/08/11 01:44:26
@@ -277,6 +277,23 @@
 	if (uio->uio_resid == 0)
 		return (0);
 
+ 	/*
+ 	 * XXX
+ 	 * We need to check for KMEM_GROUP because ps is sgid kmem;
+ 	 * not allowing it here causes ps to not work properly.  Arguably,
+ 	 * this is a bug with what ps does.  We only need to do this
+ 	 * for Pmem nodes, and only if it's reading.  This is still not
+ 	 * good, as it may still be possible to grab illicit data if
+ 	 * a process somehow gets to be KMEM_GROUP.  Note that this also
+ 	 * means that KMEM_GROUP can't change without editing procfs.h!
+ 	 * All in all, quite yucky.
+ 	 */
+ 
+ 	if (!CHECKIO(curp, p) &&
+ 	    ((curp->p_cred->pc_ucred->cr_gid != KMEM_GROUP) &&
+ 	     (uio->uio_rw != UIO_READ))
+ 		return EPERM;
+
 	return (procfs_rwmem(p, uio));
 }
 
Index: miscfs/procfs/procfs_regs.c
===================================================================
RCS file: /home/ncvs/src/sys/miscfs/procfs/procfs_regs.c,v
retrieving revision 1.7
diff -u -r1.7 procfs_regs.c
--- procfs_regs.c	1997/08/02 14:32:16	1.7
+++ procfs_regs.c	1997/08/11 01:42:06
@@ -60,6 +60,8 @@
 	char *kv;
 	int kl;
 
+	if (!CHECKIO(curp, p))
+		return EPERM;
 	kl = sizeof(r);
 	kv = (char *) &r;
 
Index: miscfs/procfs/procfs_vnops.c
===================================================================
RCS file: /home/ncvs/src/sys/miscfs/procfs/procfs_vnops.c,v
retrieving revision 1.30
diff -u -r1.30 procfs_vnops.c
--- procfs_vnops.c	1997/08/02 14:32:20	1.30
+++ procfs_vnops.c	1997/08/11 01:43:41
@@ -127,16 +127,21 @@
 	} */ *ap;
 {
 	struct pfsnode *pfs = VTOPFS(ap->a_vp);
+	struct proc *p1 = ap->a_p, *p2 = PFIND(pfs->pfs_pid);
+
+	if (p2 == NULL)
+		return ENOENT;
 
 	switch (pfs->pfs_type) {
 	case Pmem:
-		if (PFIND(pfs->pfs_pid) == 0)
-			return (ENOENT);	/* was ESRCH, jsp */
-
 		if ((pfs->pfs_flags & FWRITE) && (ap->a_mode & O_EXCL) ||
 		    (pfs->pfs_flags & O_EXCL) && (ap->a_mode & FWRITE))
 			return (EBUSY);
 
+		if (!CHECKIO(p1, p2) &&
+		    (p1->p_cred->pc_ucred->cr_gid != KMEM_GROUP))
+			return EPERM;
+
 		if (ap->a_mode & FWRITE)
 			pfs->pfs_flags = ap->a_mode & (FWRITE|O_EXCL);
 
@@ -194,7 +199,6 @@
 		struct proc *a_p;
 	} */ *ap;
 {
-
 	return (ENOTTY);
 }