On Tue, Sep 26, 2017 at 07:37:53PM +0000, Shawn Webb wrote: > Hey All, > > I'm working on applying Capsicum to Tor. I've got a PoC design for how > I'm going to do it posted here: > > https://github.com/lattera/PoCs/tree/master/capsicum_fdpassing > > Note that the above code might have ugly spots. It's mostly just a brain > dump. > > Essentially, the child process creates the socket and passes the > socket's file descriptor back to the parent. The socket file descriptor > has the capabilities sets already applied to it before it goes back to > the parent. The socket creation and file descriptor passing seems to > work well. > > However, what isn't working is calling connect(2) on the socket file > descriptor in the parent. errno gets set to ECAPMODE. This is puzzling > to me since CAP_CONNECT is set on the descriptor. > > Any help would be appreciated.
It turns out that connect(2) isn't annotated with SYF_CAPENABLED, even though the CAP_CONNECT capability exists. I've fixed it in HardenedBSD: https://github.com/HardenedBSD/hardenedBSD/commit/1b1b6b8f1ec1fbbefc5de82f0b15bb470beda370 I've also filed a bug report: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=222632 Thanks, -- Shawn Webb Cofounder and Security Engineer HardenedBSD GPG Key ID: 0x6A84658F52456EEE GPG Key Fingerprint: 2ABA B6BD EF6A F486 BE89 3D9E 6A84 658F 5245 6EEE
diff --git a/sys/kern/init_sysent.c b/sys/kern/init_sysent.c
index 125587d5057..3e216996c94 100644
--- a/sys/kern/init_sysent.c
+++ b/sys/kern/init_sysent.c
@@ -149,7 +149,7 @@ struct sysent sysent[] = {
{ AS(fsync_args), (sy_call_t *)sys_fsync, AUE_FSYNC, NULL, 0, 0, SYF_CAPENABLED, SY_THR_STATIC }, /* 95 = fsync */
{ AS(setpriority_args), (sy_call_t *)sys_setpriority, AUE_SETPRIORITY, NULL, 0, 0, SYF_CAPENABLED, SY_THR_STATIC }, /* 96 = setpriority */
{ AS(socket_args), (sy_call_t *)sys_socket, AUE_SOCKET, NULL, 0, 0, SYF_CAPENABLED, SY_THR_STATIC }, /* 97 = socket */
- { AS(connect_args), (sy_call_t *)sys_connect, AUE_CONNECT, NULL, 0, 0, 0, SY_THR_STATIC }, /* 98 = connect */
+ { AS(connect_args), (sy_call_t *)sys_connect, AUE_CONNECT, NULL, 0, 0, SYF_CAPENABLED, SY_THR_STATIC }, /* 98 = connect */
{ compat(AS(accept_args),accept), AUE_ACCEPT, NULL, 0, 0, SYF_CAPENABLED, SY_THR_STATIC }, /* 99 = old accept */
{ AS(getpriority_args), (sy_call_t *)sys_getpriority, AUE_GETPRIORITY, NULL, 0, 0, SYF_CAPENABLED, SY_THR_STATIC }, /* 100 = getpriority */
{ compat(AS(osend_args),send), AUE_SEND, NULL, 0, 0, SYF_CAPENABLED, SY_THR_STATIC }, /* 101 = old send */
signature.asc
Description: PGP signature
