Page MenuHomeFreeBSD

Disable connectat/bindat with AT_FDCWD parameter in capabilities mode
ClosedPublic

Authored by jan.kokemueller_gmail.com on Apr 28 2018, 6:09 AM.

Details

Summary

Currently it is possible to connect a socket by calling "connectat(AT_FDCWD, ...)" even in capabilties mode. This combination should probably be treated the same as a call to connect (i.e. forbidden in capabilities mode).

This patch disables connectat/bindat with AT_FDCWD in capabilities mode, fixes up the documentation and adds some tests.

See also https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=222632.

Diff Detail

Repository
rS FreeBSD src repository
Lint
Automatic diff as part of commit; lint not applicable.
Unit
Automatic diff as part of commit; unit tests not applicable.

Event Timeline

Thank you, I will try to review soon and have added some other Capsicum folks.

If you upload again please include full context, via git diff -U9999 or svn diff -x-U99999 or similar.

This revision is now accepted and ready to land.Apr 30 2018, 4:05 PM

connectat/bindat description updated in rS333119

This revision was automatically updated to reflect the committed changes.