netstat: strip the binary of sgid
AcceptedPublic
Actions

Authored by kevans on Oct 21 2024, 4:22 AM.

Details

Reviewers

glebius
markj

Group Reviewers

network

Summary

Everything in the live path seems to use sysctls these days, with kvm
only being used for pulling information from core dumps. Strip the
binary of /dev/{k,}mem access to reduce the surface area with access
to kmem.

Diff Detail

Repository

rG FreeBSD src repository

Lint

Lint Skipped

Unit

Tests Skipped

Build Status

Buildable 60109
Build 56993: arc lint + arc unit

Event Timeline

kevans created this revision.Oct 21 2024, 4:22 AM

Herald added a subscriber: imp. · View Herald TranscriptOct 21 2024, 4:22 AM

kevans requested review of this revision.Oct 21 2024, 4:22 AM

Harbormaster completed remote builds in B60109: Diff 145239.Oct 21 2024, 4:22 AM

There are some calls setgid(getgid()) in netstat which aim to drop privileges. I guess those should be removed too?

Drop setgid(2) calls meant to drop privileges, now that we don't have privs

Harbormaster completed remote builds in B60143: Diff 145329.Oct 22 2024, 3:14 AM

In D47210#1076527, @markj wrote:

There are some calls setgid(getgid()) in netstat which aim to drop privileges. I guess those should be removed too?

I also found one other call to kresolve_list() that I thought could go away, but it turns out that we actually still need /dev/mem for netstat -rs. Shelving this for the time being, but reimplementing rt_stats() for the live case doesn't seem like it'd be too difficult.

kevans added a parent revision: D47231: netstat: convert routing statistics to a sysctl.Oct 22 2024, 3:52 AM

glebius accepted this revision as: glebius.Oct 22 2024, 5:06 PM

This revision is now accepted and ready to land.Oct 22 2024, 5:06 PM

I intend to commit this on the 21st if nobody objects -- the one month anniversary to netstat(1) switching to sysctl for routing stats.

markj accepted this revision as: markj.Nov 18 2024, 1:07 AM