From owner-cvs-all  Thu Apr 12 20: 6:29 2001
Delivered-To: cvs-all@freebsd.org
Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21])
	by hub.freebsd.org (Postfix) with ESMTP
	id C0D1537B449; Thu, 12 Apr 2001 20:06:22 -0700 (PDT)
	(envelope-from rwatson@FreeBSD.org)
Received: (from rwatson@localhost)
	by freefall.freebsd.org (8.11.1/8.11.1) id f3D36M992258;
	Thu, 12 Apr 2001 20:06:22 -0700 (PDT)
	(envelope-from rwatson)
Message-Id: <200104130306.f3D36M992258@freefall.freebsd.org>
From: Robert Watson <rwatson@FreeBSD.org>
Date: Thu, 12 Apr 2001 20:06:22 -0700 (PDT)
To: cvs-committers@FreeBSD.org, cvs-all@FreeBSD.org
Subject: cvs commit: src/sys/kern kern_prot.c
X-FreeBSD-CVS-Branch: HEAD
Sender: owner-cvs-all@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.ORG

rwatson     2001/04/12 20:06:22 PDT

  Modified files:
    sys/kern             kern_prot.c 
  Log:
  o Disallow two "allow this" exceptions in p_cansignal() restricting
    the ability of unprivileged processes to deliver arbitrary signals
    to daemons temporarily taking on unprivileged effective credentials
    when P_SUGID is not set on the target process:
    Removed:
       (p1->p_cred->cr_ruid != ps->p_cred->cr_uid)
       (p1->p_ucred->cr_uid != ps->p_cred->cr_uid)
  o Replace two "allow this" exceptions in p_cansignal() restricting
    the ability of unprivileged processes to deliver arbitrary signals
    to daemons temporarily taking on unprivileged effective credentials
    when P_SUGID is set on the target process:
    Replaced:
       (p1->p_cred->p_ruid != p2->p_ucred->cr_uid)
       (p1->p_cred->cr_uid != p2->p_ucred->cr_uid)
    With:
       (p1->p_cred->p_ruid != p2->p_ucred->p_svuid)
       (p1->p_ucred->cr_uid != p2->p_ucred->p_svuid)
  o These changes have the effect of making the uid-based handling of
    both P_SUGID and non-P_SUGID signal delivery consistent, following
    these four general cases:
       p1's ruid equals p2's ruid
       p1's euid equals p2's ruid
       p1's ruid equals p2's svuid
       p1's euid equals p2's svuid
    The P_SUGID and non-P_SUGID cases can now be largely collapsed,
    and I'll commit this in a few days if no immediate problems are
    encountered with this set of changes.
  o These changes remove a number of warning cases identified by the
    proc_to_proc inter-process authorization regression test.
  o As these are new restrictions, we'll have to watch out carefully for
    possible side effects on running code: they seem reasonable to me,
    but it's possible this change might have to be backed out if problems
    are experienced.
  
  Submitted by:		src/tools/regression/security/proc_to_proc/testuid
  Reviewed by:		tmm
  Obtained from:	TrustedBSD Project
  
  Revision  Changes    Path
  1.83      +4 -6      src/sys/kern/kern_prot.c


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe cvs-all" in the body of the message