Module Name: src
Committed By: pgoyette
Date: Fri Nov 20 02:58:19 UTC 2015
Modified Files:
src/sys/dev/filemon: filemon.c
Log Message:
Ensure that the PID specified in the FILEMON_SET_PID ioctl() call
belongs to the caller or one of its descendants.
To generate a diff of this commit:
cvs rdiff -u -r1.14 -r1.15 src/sys/dev/filemon/filemon.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/dev/filemon/filemon.c
diff -u src/sys/dev/filemon/filemon.c:1.14 src/sys/dev/filemon/filemon.c:1.15
--- src/sys/dev/filemon/filemon.c:1.14 Fri Nov 20 01:33:59 2015
+++ src/sys/dev/filemon/filemon.c Fri Nov 20 02:58:19 2015
@@ -24,7 +24,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: filemon.c,v 1.14 2015/11/20 01:33:59 pgoyette Exp $");
+__KERNEL_RCSID(0, "$NetBSD: filemon.c,v 1.15 2015/11/20 02:58:19 pgoyette Exp $");
#include <sys/param.h>
#include <sys/kernel.h>
@@ -278,7 +278,7 @@ filemon_ioctl(struct file * fp, u_long c
{
int error = 0;
struct filemon *filemon;
- struct proc *tp;
+ struct proc *tp, *lp, *p;
#ifdef DEBUG
log(logLevel, "filemon_ioctl(%lu)", cmd);;
@@ -313,6 +313,26 @@ filemon_ioctl(struct file * fp, u_long c
error = ESRCH;
break;
}
+
+ /* Ensure that target proc is a descendant of curproc */
+ p = tp;
+ while (p) {
+ /*
+ * make sure p cannot exit
+ * until we have moved on to p_pptr
+ */
+ rw_enter(&p->p_reflock, RW_READER);
+ if (p == curproc) {
+ rw_exit(&p->p_reflock);
+ break;
+ }
+ lp = p;
+ p = p->p_pptr;
+ rw_exit(&lp->p_reflock);
+ }
+ if (p == NULL)
+ return EPERM;
+
error = kauth_authorize_process(curproc->p_cred,
KAUTH_PROCESS_CANSEE, tp,
KAUTH_ARG(KAUTH_REQ_PROCESS_CANSEE_ENTRY), NULL, NULL);
