HomeFreeBSD

capsicum: Limit socket operations in capability mode

Description

capsicum: Limit socket operations in capability mode

Capsicum did not prevent certain privileged networking operations,
specifically creation of raw sockets and network configuration ioctls.
However, these facilities can be used to circumvent some of the
restrictions that capability mode is supposed to enforce.

Add capability mode checks to disallow network configuration ioctls and
creation of sockets other than PF_LOCAL and SOCK_DGRAM/STREAM/SEQPACKET
internet sockets.

Reviewed by: oshogbo
Discussed with: emaste
Reported by: manu
Sponsored by: The FreeBSD Foundation
MFC after: 2 weeks
Differential Revision: https://reviews.freebsd.org/D29423

Details

Provenance
markjAuthored on Apr 7 2021, 6:19 PM
Reviewer
oshogbo
Differential Revision
D29423: capsicum: Limit socket operations in capability mode
Parents
rG12db51d20823: uefisign: handle empty sections
Branches
Unknown
Tags
Unknown