Page MenuHomeFreeBSD
Files F147323974

D7940.diff
No OneTemporary
Actions

D7940.diff
View Options

Index: head/usr.bin/tee/tee.c
===================================================================
--- head/usr.bin/tee/tee.c
+++ head/usr.bin/tee/tee.c
@@ -41,14 +41,18 @@
"$FreeBSD$";
#endif /* not lint */
-#include <sys/types.h>
+#include <sys/capsicum.h>
#include <sys/stat.h>
+#include <sys/types.h>
+
#include <err.h>
+#include <errno.h>
#include <fcntl.h>
#include <signal.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
+#include <termios.h>
#include <unistd.h>
typedef struct _list {
@@ -69,6 +73,8 @@
char *bp;
int append, ch, exitval;
char *buf;
+ cap_rights_t rights;
+ unsigned long cmd;
#define BSIZE (8 * 1024)
append = 0;
@@ -90,6 +96,16 @@
if ((buf = malloc(BSIZE)) == NULL)
err(1, "malloc");
+ cap_rights_init(&rights, CAP_READ, CAP_FSTAT);
+ if (cap_rights_limit(STDIN_FILENO, &rights) < 0 && errno != ENOSYS)
+ err(EXIT_FAILURE, "unable to limit rights for stdin");
+ cap_rights_init(&rights, CAP_WRITE, CAP_FSTAT, CAP_IOCTL);
+ if (cap_rights_limit(STDERR_FILENO, &rights) < 0 && errno != ENOSYS)
+ err(EXIT_FAILURE, "unable to limit rights for stderr");
+ cmd = TIOCGETA;
+ if (cap_ioctls_limit(STDERR_FILENO, &cmd, 1) < 0 && errno != ENOSYS)
+ err(EXIT_FAILURE, "unable to limit ioctls for stderr");
+
add(STDOUT_FILENO, "stdout");
for (exitval = 0; *argv; ++argv)
@@ -100,6 +116,8 @@
} else
add(fd, *argv);
+ if (cap_enter() < 0 && errno != ENOSYS)
+ err(EXIT_FAILURE, "unable to enter capability mode");
while ((rval = read(STDIN_FILENO, buf, BSIZE)) > 0)
for (p = head; p; p = p->next) {
n = rval;
@@ -129,6 +147,21 @@
add(int fd, const char *name)
{
LIST *p;
+ cap_rights_t rights;
+ unsigned long cmd;
+
+ if (fd == STDOUT_FILENO)
+ cap_rights_init(&rights, CAP_WRITE, CAP_FSTAT, CAP_IOCTL);
+ else
+ cap_rights_init(&rights, CAP_WRITE, CAP_FSTAT);
+ if (cap_rights_limit(fd, &rights) < 0 && errno != ENOSYS)
+ err(EXIT_FAILURE, "unable to limit rights");
+
+ if (fd == STDOUT_FILENO) {
+ cmd = TIOCGETA;
+ if (cap_ioctls_limit(fd, &cmd, 1) < 0 && errno != ENOSYS)
+ err(EXIT_FAILURE, "unable to limit ioctls for stdout");
+ }
if ((p = malloc(sizeof(LIST))) == NULL)
err(1, "malloc");

File Metadata

Mime Type
text/plain
Expires
Tue, Mar 10, 11:48 PM (8 h, 25 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
29518849
Default Alt Text
D7940.diff (2 KB)

Event Timeline