Differential D6545

filemon exec: Cease tracing if credentials will change with the new image.
ClosedPublic
Actions

Authored by bdrewery on May 24 2016, 9:09 PM.

Tags

None

Referenced Files

	Unknown Object (File)
	Mon, Sep 14, 2:31 AM

	Unknown Object (File)
	Sun, Sep 13, 1:17 PM

	Unknown Object (File)
	Sun, Sep 13, 12:59 PM

	Unknown Object (File)
	Sun, Sep 13, 11:23 AM

	Unknown Object (File)
	Sun, Sep 13, 9:35 AM

	Unknown Object (File)
	Sat, Sep 12, 3:42 PM

	Unknown Object (File)
	Sat, Sep 12, 12:35 PM

	Unknown Object (File)
	Sat, Sep 12, 12:21 PM

Subscribers

Details

Reviewers

kib
mjg

Commits

rS300890: exec: Cease tracing if credentials will change with the new image.

Summary

This also prevents tracing to a P_INEXEC process since it could race
with other processes attaching to it in filemon_event_process_exec() due
to the filemon_get_proc() race of incrementing ref and then locking the
filemon. With the no-P_INEXEC invariant in place the p_filemon may only
be the same or NULL when trying to drop it in
filemon_event_process_exec().

MFC after: 2 weeks
Sponsored by: EMC / Isilon Storage Division

Test Plan

Ran filemon with script(1) with a suid binary and confirmed that no tracing of
the suid binary or its children were traced. Upon returning from the suid
process, the parent process continued to show its own tracing information.

Diff Detail

Repository

rS FreeBSD src repository - subversion

Lint

Lint Passed

Unit

No Test Coverage

Build Status

Buildable 3933
Build 3976: arc lint + arc unit

Event Timeline

bdrewery updated this revision to Diff 16819.May 24 2016, 9:09 PM

bdrewery retitled this revision from to filemon exec: Cease tracing if credentials will change with the new image..

bdrewery updated this object.

bdrewery edited the test plan for this revision. (Show Details)

bdrewery added reviewers: kib, mjg.

Herald added a subscriber: imp. · View Herald TranscriptMay 24 2016, 9:09 PM

bdrewery added a parent revision: D6544: exec: Add credential change information into imgp for process_exec hook..May 24 2016, 9:09 PM

Replace removed credential_changing with more proper credential_setid - only cease tracing if going setid

Closed by commit rS300890: exec: Cease tracing if credentials will change with the new image. (authored by bdrewery). · Explain WhyMay 27 2016, 11:57 PM

This revision was automatically updated to reflect the committed changes.

Revision Contents
Changeset List

Path

Size

sys/

dev/

filemon/

13 lines

filemon_wrapper.c

19 lines

Diff 16819

sys/dev/filemon/filemon.c

Loading...

sys/dev/filemon/filemon_wrapper.c

Loading...