Page MenuHomeFreeBSD

Disable connectat/bindat with AT_FDCWD parameter in capabilities mode
ClosedPublic

Authored by jan.kokemueller_gmail.com on Apr 28 2018, 6:09 AM.
Referenced Files
Unknown Object (File)
Feb 20 2024, 11:00 PM
Unknown Object (File)
Feb 19 2024, 7:03 AM
Unknown Object (File)
Jan 20 2024, 3:39 AM
Unknown Object (File)
Dec 10 2023, 3:23 PM
Unknown Object (File)
Nov 23 2023, 3:53 PM
Unknown Object (File)
Nov 7 2023, 2:56 AM
Unknown Object (File)
Nov 6 2023, 2:31 PM
Unknown Object (File)
Oct 24 2023, 12:46 AM

Details

Summary

Currently it is possible to connect a socket by calling "connectat(AT_FDCWD, ...)" even in capabilties mode. This combination should probably be treated the same as a call to connect (i.e. forbidden in capabilities mode).

This patch disables connectat/bindat with AT_FDCWD in capabilities mode, fixes up the documentation and adds some tests.

See also https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=222632.

Diff Detail

Repository
rS FreeBSD src repository - subversion
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

Thank you, I will try to review soon and have added some other Capsicum folks.

If you upload again please include full context, via git diff -U9999 or svn diff -x-U99999 or similar.

This revision is now accepted and ready to land.Apr 30 2018, 4:05 PM

connectat/bindat description updated in rS333119

This revision was automatically updated to reflect the committed changes.