Page MenuHomeFreeBSD
Files F177463658

D61412.1794480671.diff
No OneTemporary
Actions

Authored By
Unknown
Size
3 KB
Referenced Files
None
Subscribers
None

D61412.1794480671.diff
View Options

diff --git a/sys/kern/kern_resource.c b/sys/kern/kern_resource.c
--- a/sys/kern/kern_resource.c
+++ b/sys/kern/kern_resource.c
@@ -336,6 +336,11 @@
p = td->td_proc;
td1 = td;
PROC_LOCK(p);
+ } else if (IN_CAPABILITY_MODE(td)) {
+ td1 = tdfind(lwpid, td->td_proc->p_pid);
+ if (td1 == NULL)
+ return (ECAPMODE);
+ p = td1->td_proc;
} else {
td1 = tdfind(lwpid, -1);
if (td1 == NULL)
@@ -423,6 +428,8 @@
p = td->td_proc;
PROC_LOCK(p);
} else {
+ if (IN_CAPABILITY_MODE(td) && pid != td->td_proc->p_pid)
+ return (ECAPMODE);
p = pfind(pid);
if (p == NULL)
return (ESRCH);
diff --git a/sys/kern/p1003_1b.c b/sys/kern/p1003_1b.c
--- a/sys/kern/p1003_1b.c
+++ b/sys/kern/p1003_1b.c
@@ -40,6 +40,7 @@
#include <sys/param.h>
#include <sys/systm.h>
+#include <sys/capsicum.h>
#include <sys/kernel.h>
#include <sys/lock.h>
#include <sys/module.h>
@@ -123,6 +124,8 @@
targettd = td;
PROC_LOCK(targetp);
} else {
+ if (IN_CAPABILITY_MODE(td) && uap->pid != td->td_proc->p_pid)
+ return (ECAPMODE);
targetp = pfind(uap->pid);
if (targetp == NULL)
return (ESRCH);
@@ -164,6 +167,8 @@
targettd = td;
PROC_LOCK(targetp);
} else {
+ if (IN_CAPABILITY_MODE(td) && uap->pid != td->td_proc->p_pid)
+ return (ECAPMODE);
targetp = pfind(uap->pid);
if (targetp == NULL) {
return (ESRCH);
@@ -211,6 +216,8 @@
targettd = td;
PROC_LOCK(targetp);
} else {
+ if (IN_CAPABILITY_MODE(td) && uap->pid != td->td_proc->p_pid)
+ return (ECAPMODE);
targetp = pfind(uap->pid);
if (targetp == NULL)
return (ESRCH);
@@ -257,6 +264,8 @@
targettd = td;
PROC_LOCK(targetp);
} else {
+ if (IN_CAPABILITY_MODE(td) && uap->pid != td->td_proc->p_pid)
+ return (ECAPMODE);
targetp = pfind(uap->pid);
if (targetp == NULL)
return (ESRCH);
@@ -343,6 +352,8 @@
targetp = td->td_proc;
PROC_LOCK(targetp);
} else {
+ if (IN_CAPABILITY_MODE(td) && pid != td->td_proc->p_pid)
+ return (ECAPMODE);
targetp = pfind(pid);
if (targetp == NULL)
return (ESRCH);
diff --git a/tests/sys/capsicum/capmode.cc b/tests/sys/capsicum/capmode.cc
--- a/tests/sys/capsicum/capmode.cc
+++ b/tests/sys/capsicum/capmode.cc
@@ -10,6 +10,8 @@
#include <sys/wait.h>
#include <sys/time.h>
#include <sys/resource.h>
+#include <sys/rtprio.h>
+#include <sys/thr.h>
#include <sys/ptrace.h>
#include <dirent.h>
#include <net/if.h>
@@ -732,3 +734,46 @@
signal(SIGUSR1, original);
}
+
+FORK_TEST(Capmode, SelfSched) {
+ pid_t me = getpid();
+ long my_tid, child_tid;
+ int pipefds[2];
+
+ EXPECT_OK(thr_self(&my_tid));
+ EXPECT_OK(pipe(pipefds));
+ pid_t child = fork();
+ if (child == 0) {
+ // Child: report thread ID, sleep and exit
+ thr_self(&child_tid);
+ write(pipefds[1], &child_tid, sizeof(child_tid));
+ sleep(1);
+ exit(0);
+ }
+ EXPECT_EQ((ssize_t)sizeof(child_tid),
+ read(pipefds[0], &child_tid, sizeof(child_tid)));
+
+ EXPECT_OK(cap_enter()); // Enter capability mode.
+
+ // Can only query or modify scheduling parameters of own pid.
+ struct sched_param sp;
+ EXPECT_CAPMODE(sched_getparam(child, &sp));
+ EXPECT_OK(sched_getparam(me, &sp));
+ EXPECT_CAPMODE(sched_setparam(child, &sp));
+ EXPECT_CAPMODE(sched_getscheduler(child));
+ int policy = sched_getscheduler(me);
+ EXPECT_OK(policy);
+ EXPECT_CAPMODE(sched_setscheduler(child, policy, &sp));
+ struct timespec ts;
+ EXPECT_CAPMODE(sched_rr_get_interval(child, &ts));
+ EXPECT_OK(sched_rr_get_interval(me, &ts));
+
+ struct rtprio rtp;
+ EXPECT_CAPMODE(rtprio(RTP_LOOKUP, child, &rtp));
+ EXPECT_OK(rtprio(RTP_LOOKUP, me, &rtp));
+ EXPECT_CAPMODE(rtprio_thread(RTP_LOOKUP, child_tid, &rtp));
+ EXPECT_OK(rtprio_thread(RTP_LOOKUP, my_tid, &rtp));
+
+ close(pipefds[0]);
+ close(pipefds[1]);
+}

File Metadata

Mime Type
text/plain
Expires
Thu, Nov 12, 10:51 AM (17 h, 51 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
41668024
Default Alt Text
D61412.1794480671.diff (3 KB)

Event Timeline