CVSROOT: /cvs
Module name: src
Changes by: [email protected] 2017/01/23 21:09:59
Modified files:
sys/sys : filedesc.h
sys/kern : uipc_usrreq.c kern_descrip.c
Log message:
Track a per-fd flag UF_PLEDGED. This indicates the initial open was done by a
pledged process. dup(2) and recvmsg(2) retain UF_PLEDGED from the original fd.
In pledge "exec" circumstances, exceve clears UF_PLEDGED on all the process's
fds.
In a pledge'd process, ioctl(2) can use this additional information to grant
access to ioctl's which are more sensitive or dive deeply into the kernel.
Developers will be encouraged to open such sensitive resources before calling
pledge(2), rather than afterwards. That matches the heading of privsep
development practices.
Future changes will introduce those ioctl(2) changes.
Lots of discussions with semarie guenther and benno.
