Skip site navigation (1)Skip section navigation (2) 
Date:      Thu, 19 Dec 2013 00:51:48 +0000 (UTC)
From:      Pawel Jakub Dawidek <pjd@FreeBSD.org>
To:        src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org
Subject:   svn commit: r259580 - in head: contrib/tcpdump usr.bin/kdump
Message-ID:  <201312190051.rBJ0pmFc055325@svn.freebsd.org>
next in thread | raw e-mail | index | archive | help 
Author: pjd
Date: Thu Dec 19 00:51:48 2013
New Revision: 259580
URL: http://svnweb.freebsd.org/changeset/base/259580

Log:
  If we cannot connect to casperd we don't enter sandbox, but if we can connect
  to casperd, but we cannot access the service we need we exit with an error.
  This should not happen and just indicates some configuration error which
  should be fixed, so we force the user to do it by failing.
  
  Discussed with:	emaste

Modified:
  head/contrib/tcpdump/tcpdump.c
  head/usr.bin/kdump/kdump.c

Modified: head/contrib/tcpdump/tcpdump.c
==============================================================================
--- head/contrib/tcpdump/tcpdump.c	Wed Dec 18 23:39:42 2013	(r259579)
+++ head/contrib/tcpdump/tcpdump.c	Thu Dec 19 00:51:48 2013	(r259580)
@@ -710,24 +710,16 @@ capdns_setup(void)
 	capdnsloc = cap_service_open(capcas, "system.dns");
 	/* Casper capability no longer needed. */
 	cap_close(capcas);
-	if (capdnsloc == NULL) {
-		warning("unable to open system.dns service");
-		return (NULL);
-	}
+	if (capdnsloc == NULL)
+		error("unable to open system.dns service");
 	/* Limit system.dns to reverse DNS lookups. */
 	types[0] = "ADDR";
-	if (cap_dns_type_limit(capdnsloc, types, 1) < 0) {
-		warning("unable to limit access to system.dns service");
-		cap_close(capdnsloc);
-		return (NULL);
-	}
+	if (cap_dns_type_limit(capdnsloc, types, 1) < 0)
+		error("unable to limit access to system.dns service");
 	families[0] = AF_INET;
 	families[1] = AF_INET6;
-	if (cap_dns_family_limit(capdnsloc, families, 2) < 0) {
-		warning("unable to limit access to system.dns service");
-		cap_close(capdnsloc);
-		return (NULL);
-	}
+	if (cap_dns_family_limit(capdnsloc, families, 2) < 0)
+		error("unable to limit access to system.dns service");
 
 	return (capdnsloc);
 }

Modified: head/usr.bin/kdump/kdump.c
==============================================================================
--- head/usr.bin/kdump/kdump.c	Wed Dec 18 23:39:42 2013	(r259579)
+++ head/usr.bin/kdump/kdump.c	Thu Dec 19 00:51:48 2013	(r259580)
@@ -215,7 +215,7 @@ cappwdgrp_setup(cap_channel_t **cappwdp,
 	capcas = cap_init();
 	if (capcas == NULL) {
 		warn("unable to contact casperd");
-		return (NULL);
+		return (-1);
 	}
 	cappwdloc = cap_service_open(capcas, "system.pwd");
 	capgrploc = cap_service_open(capcas, "system.grp");
@@ -226,40 +226,26 @@ cappwdgrp_setup(cap_channel_t **cappwdp,
 			warn("unable to open system.pwd service");
 		if (capgrploc == NULL)
 			warn("unable to open system.grp service");
-		goto fail;
+		exit(1);
 	}
 	/* Limit system.pwd to only getpwuid() function and pw_name field. */
 	cmds[0] = "getpwuid";
-	if (cap_pwd_limit_cmds(cappwdloc, cmds, 1) < 0) {
-		warn("unable to limit access to system.pwd service");
-		goto fail;
-	}
+	if (cap_pwd_limit_cmds(cappwdloc, cmds, 1) < 0)
+		err(1, "unable to limit system.pwd service");
 	fields[0] = "pw_name";
-	if (cap_pwd_limit_fields(cappwdloc, fields, 1) < 0) {
-		warn("unable to limit access to system.pwd service");
-		goto fail;
-	}
+	if (cap_pwd_limit_fields(cappwdloc, fields, 1) < 0)
+		err(1, "unable to limit system.pwd service");
 	/* Limit system.grp to only getgrgid() function and gr_name field. */
 	cmds[0] = "getgrgid";
-	if (cap_grp_limit_cmds(capgrploc, cmds, 1) < 0) {
-		warn("unable to limit access to system.grp service");
-		goto fail;
-	}
+	if (cap_grp_limit_cmds(capgrploc, cmds, 1) < 0)
+		err(1, "unable to limit system.grp service");
 	fields[0] = "gr_name";
-	if (cap_grp_limit_fields(capgrploc, fields, 1) < 0) {
-		warn("unable to limit access to system.grp service");
-		goto fail;
-	}
+	if (cap_grp_limit_fields(capgrploc, fields, 1) < 0)
+		err(1, "unable to limit system.grp service");
 
 	*cappwdp = cappwdloc;
 	*capgrpp = capgrploc;
 	return (0);
-fail:
-	if (capgrploc == NULL)
-		cap_close(cappwdloc);
-	if (capgrploc == NULL)
-		cap_close(capgrploc);
-	return (-1);
 }
 #endif	/* HAVE_LIBCAPSICUM */

Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201312190051.rBJ0pmFc055325>