Page MenuHomeFreeBSD
Files F171338309

D51645.id159474.diff
No OneTemporary
Actions

D51645.id159474.diff
View Options

diff --git a/sys/kern/kern_jail.c b/sys/kern/kern_jail.c
--- a/sys/kern/kern_jail.c
+++ b/sys/kern/kern_jail.c
@@ -4009,6 +4009,7 @@
case PRIV_DEBUG_DIFFCRED:
case PRIV_DEBUG_SUGID:
case PRIV_DEBUG_UNPRIV:
+ case PRIV_DEBUG_DIFFJAIL:
/*
* Allow jail to set various resource limits and login
@@ -4046,8 +4047,10 @@
*/
case PRIV_SCHED_DIFFCRED:
case PRIV_SCHED_CPUSET:
+ case PRIV_SCHED_DIFFJAIL:
case PRIV_SIGNAL_DIFFCRED:
case PRIV_SIGNAL_SUGID:
+ case PRIV_SIGNAL_DIFFJAIL:
/*
* Allow jailed processes to write to sysctls marked as jail
diff --git a/sys/kern/kern_prot.c b/sys/kern/kern_prot.c
--- a/sys/kern/kern_prot.c
+++ b/sys/kern/kern_prot.c
@@ -2039,6 +2039,20 @@
return (error);
}
+ /*
+ * At this point, the target may be in a different jail than the
+ * subject -- the subject must be in a parent jail to the target,
+ * whether it is prison0 or a subordinate of prison0 that has
+ * children. Additional privileges are required to allow this, as
+ * whether the creds are truly equivalent or not must be determined on
+ * a case-by-case basis.
+ */
+ if (cred->cr_prison != proc->p_ucred->cr_prison) {
+ error = priv_check_cred(cred, PRIV_SIGNAL_DIFFJAIL);
+ if (error)
+ return (error);
+ }
+
return (0);
}
@@ -2115,6 +2129,11 @@
if (error)
return (error);
}
+ if (td->td_ucred->cr_prison != p->p_ucred->cr_prison) {
+ error = priv_check(td, PRIV_SCHED_DIFFJAIL);
+ if (error)
+ return (error);
+ }
return (0);
}
@@ -2235,6 +2254,12 @@
return (error);
}
+ if (td->td_ucred->cr_prison != p->p_ucred->cr_prison) {
+ error = priv_check(td, PRIV_DEBUG_DIFFJAIL);
+ if (error)
+ return (error);
+ }
+
/* Can't trace init when securelevel > 0. */
if (p == initproc) {
error = securelevel_gt(td->td_ucred, 0);
diff --git a/sys/sys/priv.h b/sys/sys/priv.h
--- a/sys/sys/priv.h
+++ b/sys/sys/priv.h
@@ -115,6 +115,7 @@
#define PRIV_DEBUG_SUGID 81 /* Exempt debugging setuid proc. */
#define PRIV_DEBUG_UNPRIV 82 /* Exempt unprivileged debug limit. */
#define PRIV_DEBUG_DENIED 83 /* Exempt P2_NOTRACE. */
+#define PRIV_DEBUG_DIFFJAIL 84 /* Exempt debugging other jails. */
/*
* Dtrace privileges.
@@ -193,6 +194,7 @@
#define PRIV_SCHED_CPUSET 206 /* Can manipulate cpusets. */
#define PRIV_SCHED_CPUSET_INTR 207 /* Can adjust IRQ to CPU binding. */
#define PRIV_SCHED_IDPRIO 208 /* Can set idle time scheduling. */
+#define PRIV_SCHED_DIFFJAIL 209 /* Exempt scheduling other jails. */
/*
* POSIX semaphore privileges.
@@ -204,6 +206,7 @@
*/
#define PRIV_SIGNAL_DIFFCRED 230 /* Exempt signalling other users. */
#define PRIV_SIGNAL_SUGID 231 /* Non-conserv signal setuid proc. */
+#define PRIV_SIGNAL_DIFFJAIL 232 /* Exempt signalling other jails. */
/*
* Sysctl privileges.

File Metadata

Mime Type
text/plain
Expires
Fri, Sep 11, 1:00 PM (11 m, 33 s)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
38706270
Default Alt Text
D51645.id159474.diff (2 KB)

Event Timeline