Author: jamie
Date: Fri Jul 5 21:31:16 2013
New Revision: 252841
URL: http://svnweb.freebsd.org/changeset/base/252841
Log:
Add new privileges, PRIV_KMEM_READ and PRIV_KMEM_WRITE, used in opening
/dev/kmem and /dev/mem (in addition to traditional file permission checks).
PRIV_KMEM_READ is different from other PRIV_* checks in that it's allowed
by default.
Reviewed by: kib, mckusick
Modified:
head/sys/dev/mem/memdev.c
head/sys/kern/kern_priv.c
head/sys/sys/priv.h
Modified: head/sys/dev/mem/memdev.c
==============================================================================
--- head/sys/dev/mem/memdev.c Fri Jul 5 21:29:59 2013 (r252840)
+++ head/sys/dev/mem/memdev.c Fri Jul 5 21:31:16 2013 (r252841)
@@ -37,6 +37,7 @@ __FBSDID("$FreeBSD$");
#include <sys/memrange.h>
#include <sys/module.h>
#include <sys/mutex.h>
+#include <sys/priv.h>
#include <sys/proc.h>
#include <sys/signalvar.h>
#include <sys/systm.h>
@@ -67,8 +68,14 @@ memopen(struct cdev *dev __unused, int f
{
int error = 0;
- if (flags & FWRITE)
- error = securelevel_gt(td->td_ucred, 0);
+ if (flags & FREAD)
+ error = priv_check(td, PRIV_KMEM_READ);
+ if (flags & FWRITE) {
+ if (error == 0)
+ error = priv_check(td, PRIV_KMEM_WRITE);
+ if (error == 0)
+ error = securelevel_gt(td->td_ucred, 0);
+ }
return (error);
}
Modified: head/sys/kern/kern_priv.c
==============================================================================
--- head/sys/kern/kern_priv.c Fri Jul 5 21:29:59 2013 (r252840)
+++ head/sys/kern/kern_priv.c Fri Jul 5 21:31:16 2013 (r252841)
@@ -142,6 +142,15 @@ priv_check_cred(struct ucred *cred, int
}
/*
+ * Writes to kernel memory are a typical root-only operation,
+ * but non-root users are expected to be able to read it.
+ */
+ if (priv == PRIV_KMEM_READ) {
+ error = 0;
+ goto out;
+ }
+
+ /*
* Now check with MAC, if enabled, to see if a policy module grants
* privilege.
*/
Modified: head/sys/sys/priv.h
==============================================================================
--- head/sys/sys/priv.h Fri Jul 5 21:29:59 2013 (r252840)
+++ head/sys/sys/priv.h Fri Jul 5 21:31:16 2013 (r252841)
@@ -494,6 +494,12 @@
#define PRIV_RCTL_REMOVE_RULE 674
/*
+ * Kernel memory privileges.
+ */
+#define PRIV_KMEM_READ 680 /* Read from kernel memory. */
+#define PRIV_KMEM_WRITE 681 /* Write to kernel memory. */
+
+/*
* Track end of privilege list.
*/
#define _PRIV_HIGHEST 675
_______________________________________________
svn-src-head@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/svn-src-head
To unsubscribe, send any mail to "svn-src-head-unsubscr...@freebsd.org"
