On 11/18/16 16:03, Adrian Chadd wrote: > fwiw, this breaks -head compilation. > > > > -a >
This seems to not allow head to be built on stable/10 (not strictly supported, but worked until this commit) ... I haven't tried building head on stable/11 as of yet, but I assume it will break there too? sean > > On 18 November 2016 at 13:09, Bartek Rutkowski <ro...@freebsd.org> wrote: >> Author: robak (ports committer) >> Date: Fri Nov 18 21:09:57 2016 >> New Revision: 308810 >> URL: https://svnweb.freebsd.org/changeset/base/308810 >> >> Log: >> Capsicum support for dd(1) >> >> Adds Capsicum sandboxing to dd utility. >> >> Submitted by: Pawel Biernacki <pawel.bierna...@gmail.com> >> Reviewed by: allanjude, emaste, oshogbo >> Approved by: oshogbo >> Sponsored by: Mysterious Code Ltd. >> Differential Revision: https://reviews.freebsd.org/D8543 >> >> Modified: >> head/bin/dd/dd.c >> >> Modified: head/bin/dd/dd.c >> ============================================================================== >> --- head/bin/dd/dd.c Fri Nov 18 17:18:05 2016 (r308809) >> +++ head/bin/dd/dd.c Fri Nov 18 21:09:57 2016 (r308810) >> @@ -48,10 +48,13 @@ __FBSDID("$FreeBSD$"); >> #include <sys/param.h> >> #include <sys/stat.h> >> #include <sys/conf.h> >> +#include <sys/capsicum.h> >> #include <sys/disklabel.h> >> #include <sys/filio.h> >> +#include <sys/mtio.h> >> >> #include <assert.h> >> +#include <capsicum_helpers.h> >> #include <ctype.h> >> #include <err.h> >> #include <errno.h> >> @@ -92,6 +95,10 @@ main(int argc __unused, char *argv[]) >> jcl(argv); >> setup(); >> >> + caph_cache_catpages(); >> + if (cap_enter() == -1 && errno != ENOSYS) >> + err(1, "unable to enter capability mode"); >> + >> (void)signal(SIGINFO, siginfo_handler); >> (void)signal(SIGINT, terminate); >> >> @@ -125,6 +132,8 @@ static void >> setup(void) >> { >> u_int cnt; >> + cap_rights_t rights; >> + unsigned long cmds[] = { FIODTYPE, MTIOCTOP }; >> >> if (in.name == NULL) { >> in.name = "stdin"; >> @@ -133,13 +142,20 @@ setup(void) >> in.fd = open(in.name, O_RDONLY, 0); >> if (in.fd == -1) >> err(1, "%s", in.name); >> + if (caph_limit_stdin() == -1) >> + err(1, "unable to limit capability rights"); >> } >> >> getfdtype(&in); >> >> + cap_rights_init(&rights, CAP_READ, CAP_SEEK); >> + if (cap_rights_limit(in.fd, &rights) == -1 && errno != ENOSYS) >> + err(1, "unable to limit capability rights"); >> + >> if (files_cnt > 1 && !(in.flags & ISTAPE)) >> errx(1, "files is not supported for non-tape devices"); >> >> + cap_rights_set(&rights, CAP_WRITE, CAP_FTRUNCATE, CAP_IOCTL); >> if (out.name == NULL) { >> /* No way to check for read access here. */ >> out.fd = STDOUT_FILENO; >> @@ -156,13 +172,27 @@ setup(void) >> if (out.fd == -1) { >> out.fd = open(out.name, O_WRONLY | OFLAGS, >> DEFFILEMODE); >> out.flags |= NOREAD; >> + cap_rights_clear(&rights, CAP_READ); >> } >> if (out.fd == -1) >> err(1, "%s", out.name); >> + if (caph_limit_stdout() == -1) >> + err(1, "unable to limit capability rights"); >> } >> >> getfdtype(&out); >> >> + if (cap_rights_limit(out.fd, &rights) == -1 && errno != ENOSYS) >> + err(1, "unable to limit capability rights"); >> + if (cap_ioctls_limit(out.fd, cmds, nitems(cmds)) == -1 && >> + errno != ENOSYS) >> + err(1, "unable to limit capability rights"); >> + >> + if (in.fd != STDERR_FILENO && out.fd != STDERR_FILENO) { >> + if (caph_limit_stderr() == -1) >> + err(1, "unable to limit capability rights"); >> + } >> + >> /* >> * Allocate space for the input and output buffers. If not doing >> * record oriented I/O, only need a single buffer. >> > >
signature.asc
Description: OpenPGP digital signature