hexdump: actually enter Capsicum sandbox on last file

[emaste]

Test Plan

Without D10893 applied hexdump fails with -s. Verify that this is caught as ENOTCAPABLE or ECAPMODE in capability mode:

nuc% proccontrol -m trapcap usr.bin/hexdump/obj/hexdump -s 1 /bin/ls
zsh: trace trap  proccontrol -m trapcap usr.bin/hexdump/obj/hexdump -s 1 /bin/ls
nuc%

[cem]

usr.bin/hexdump/display.c

369 ↗

(On Diff #28776)

This can be spelled if (_argv[1] == NULL) {, I think.

[kib]

usr.bin/hexdump/display.c

376 ↗

(On Diff #28776)

I am looking simultaneously at this line and at the test that you changed in the review, and I think that at least one more thing is wrong after it. If *_argv can be NULL, i..e. point past the last argument, then testing *(_argv + 1) is not safe.

[emaste]

• print correct arg in err case
• do not access *(argv + 1) if already at end of argv list

[emaste]

usr.bin/hexdump/display.c

369 ↗

(On Diff #28776)

It could although I'm not sure that's clearer. I dislike combining array access and ++_argv pointer manipulation.

[jhb]

This entire approach seems sketchy. If you give hexdump multiple files, it only cap_enter()'s for the last file but not the first N files? That just means that if there is a malicious file that triggers some sort of overflow, etc. I just need (as the user) to append "/dev/null" on the command line to get hexdump to parse the malicious file without being in capability mode. It seems to me that you should either open all the files up front, or you pass fds of files into a compartment that does the actual hexdump.

[cem]

In D10897#229437, @jhb wrote:

This entire approach seems sketchy. If you give hexdump multiple files, it only cap_enter()'s for the last file but not the first N files? That just means that if there is a malicious file that triggers some sort of overflow, etc. I just need (as the user) to append "/dev/null" on the command line to get hexdump to parse the malicious file without being in capability mode. It seems to me that you should either open all the files up front, or you pass fds of files into a compartment that does the actual hexdump.

Yeah, it's a limited form of capisicumization. It's a pattern used elsewhere in the tree, too. It still helps when the malicious actor cannot control program arguments, and especially in the common case where only one file is passed.

Unfortunately, neither opening all files up front or rearchitecting the program as a two-process sandbox is totally trivial.