mirror of
https://github.com/freebsd/freebsd-src
synced 2024-09-06 17:18:32 +00:00
ktrace: Record socket violations with KTR_CAPFAIL
Report restricted access to socket addresses and protocols while Capsicum violation tracing with CAPFAIL_ADDR and CAPFAIL_PROTO. Reviewed by: markj Approved by: markj (mentor) MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D40681
This commit is contained in:
parent
0cd9cde767
commit
aa32d7cbc9
|
@ -104,6 +104,7 @@
|
|||
#include "opt_inet.h"
|
||||
#include "opt_inet6.h"
|
||||
#include "opt_kern_tls.h"
|
||||
#include "opt_ktrace.h"
|
||||
#include "opt_sctp.h"
|
||||
|
||||
#include <sys/param.h>
|
||||
|
@ -522,8 +523,12 @@ socreate(int dom, struct socket **aso, int type, int proto,
|
|||
|
||||
MPASS(prp->pr_attach);
|
||||
|
||||
if (IN_CAPABILITY_MODE(td) && (prp->pr_flags & PR_CAPATTACH) == 0)
|
||||
return (ECAPMODE);
|
||||
if ((prp->pr_flags & PR_CAPATTACH) == 0) {
|
||||
if (CAP_TRACING(td))
|
||||
ktrcapfail(CAPFAIL_PROTO, &proto);
|
||||
if (IN_CAPABILITY_MODE(td))
|
||||
return (ECAPMODE);
|
||||
}
|
||||
|
||||
if (prison_check_af(cred, prp->pr_domain->dom_family) != 0)
|
||||
return (EPROTONOSUPPORT);
|
||||
|
|
|
@ -654,11 +654,6 @@ sendit(struct thread *td, int s, struct msghdr *mp, int flags)
|
|||
struct sockaddr *to;
|
||||
int error;
|
||||
|
||||
#ifdef CAPABILITY_MODE
|
||||
if (IN_CAPABILITY_MODE(td) && (mp->msg_name != NULL))
|
||||
return (ECAPMODE);
|
||||
#endif
|
||||
|
||||
if (mp->msg_name != NULL) {
|
||||
error = getsockaddr(&to, mp->msg_name, mp->msg_namelen);
|
||||
if (error != 0) {
|
||||
|
@ -666,6 +661,14 @@ sendit(struct thread *td, int s, struct msghdr *mp, int flags)
|
|||
goto bad;
|
||||
}
|
||||
mp->msg_name = to;
|
||||
#ifdef CAPABILITY_MODE
|
||||
if (CAP_TRACING(td))
|
||||
ktrcapfail(CAPFAIL_SOCKADDR, mp->msg_name);
|
||||
if (IN_CAPABILITY_MODE(td)) {
|
||||
error = ECAPMODE;
|
||||
goto bad;
|
||||
}
|
||||
#endif
|
||||
} else {
|
||||
to = NULL;
|
||||
}
|
||||
|
|
Loading…
Reference in a new issue