Page MenuHomeFreeBSD

Disable connectat/bindat with AT_FDCWD parameter in capabilities mode

Authored by on Apr 28 2018, 6:09 AM.



Currently it is possible to connect a socket by calling "connectat(AT_FDCWD, ...)" even in capabilties mode. This combination should probably be treated the same as a call to connect (i.e. forbidden in capabilities mode).

This patch disables connectat/bindat with AT_FDCWD in capabilities mode, fixes up the documentation and adds some tests.

See also

Diff Detail

rS FreeBSD src repository
Automatic diff as part of commit; lint not applicable.
Automatic diff as part of commit; unit tests not applicable.

Event Timeline

Thank you, I will try to review soon and have added some other Capsicum folks.

If you upload again please include full context, via git diff -U9999 or svn diff -x-U99999 or similar.

This revision is now accepted and ready to land.Apr 30 2018, 4:05 PM

connectat/bindat description updated in rS333119

This revision was automatically updated to reflect the committed changes.