Page MenuHomeFreeBSD

libusb: capsicumize libusb
Needs ReviewPublic

Authored by aokblast on Mon, Aug 11, 3:54 PM.
Tags
None
Referenced Files
Unknown Object (File)
Wed, Aug 20, 2:26 AM
Unknown Object (File)
Wed, Aug 20, 1:58 AM
Unknown Object (File)
Wed, Aug 20, 1:21 AM
Unknown Object (File)
Wed, Aug 20, 1:13 AM
Unknown Object (File)
Wed, Aug 20, 12:46 AM
Unknown Object (File)
Wed, Aug 20, 12:45 AM
Unknown Object (File)
Wed, Aug 20, 12:45 AM
Unknown Object (File)
Wed, Aug 20, 12:44 AM
Subscribers

Details

Reviewers
jfree
pjd
markj
oshogbo
lwhsu
Group Reviewers
capsicum
Summary

FreeBSD's libusb has three components: libusb01, libusb10, and libusb20.

libusb20 handles communication with character devices. We now accept
file descriptors (FDs) for /dev/usb (usbd_fd) and /dev/usbctl (cfd)
directly, allowing users to open these and apply capabilities
themselves.

libusb10 is updated to support capabilities via a context option. Since
libusb allows general read/write access, we preserve all possible
capabilities when passing FDs to libusb20. It's the responsibility of
the libusb user to call cap_enter() at an appropriate time.

libusb01 is currently unused, so Capsicum support is not implemented for
it.

All base system tools using libusb20 have been updated to support
Capsicum.

Sponsored by: The FreeBSD Foundation

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Passed
Unit
No Test Coverage
Build Status
Buildable 66341
Build 63224: arc lint + arc unit

Event Timeline

tools/tools/usbtest/usb_msc_test.c
970

Is this just general unused variable cleanup? I tend to do these small unrelated cleanups in separate patches. This way, the small cleanup gets its own commit and stays if your bigger patch needs to be reverted for whatever reason.

usr.sbin/usbconfig/usbconfig.c
641

In the rest of your patch, you opened usbd_fd as a normal descriptor with O_RDONLY and now you're opening it as a directory descriptor. Maybe the rest of the usbd_fd open() calls should be updated to use O_PATH | O_DIRECTORY and I think you could eliminate most of the capabilities in your rights list for usbd_fd since I only see you using it for openat().

usr.sbin/usbconfig/usbconfig.c
641

The fd returns from the openat will inherit all of the capabilities from the fd pass to openat. Therefore, for the /dev/usb/*.*.* devices, we should give the usbd_fd, READ, WRITE, EVENT, IOCTL for later usage.

Good to see more Capsicumization efforts going on. I just had a few pedantic suggestions. Otherwise, this generally looks good.

lib/libusb/libusb.3
904–905

I'd add a .Xr capsicum 4 here since you're mentioning it earlier.

usr.sbin/usbconfig/usbconfig.c
48–49

These extern declarations aren't really doing anything since you declare both variables right below.

The extern declarations in dump.c should be enough. You could move them into a header and include that if you anticipate other source files needing to access them as well.

641

Oops, you're definitely right. Looks good to me then :)

Fix incorrect close fd for libusb

usr.sbin/usbconfig/usbconfig.c
48–49

You are right, I am too lazy:). Fix it now.

recover status when capsicum failed