system/freebsd-src
system/freebsd-src
1
0
Fork 0
mirror of https://github.com/freebsd/freebsd-src synced 2024-07-22 18:56:38 +00:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

cap_net: correct capability name from addr2name to name2addr

Browse source 
Previously, while checking name2addr capabilities, we mistakenly used
the addr2name set. This error could cause a process to inadvertently
reset its limitations.

Reported by:	Shawn Webb <shawn.webb@hardenedbsd.org>
This commit is contained in:
Mariusz Zaborski 2023-10-23 23:03:51 +02:00
parent 934a24e55a
commit afd74c4000
2 changed files with 13 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
lib/libcasper/services/cap_net/cap_net.c
View file

@ -1232,7 +1232,7 @@ verify_name2addr_newlimits(const nvlist_t *oldlimits,
oldfunclimits = NULL;
if (oldlimits != NULL) {
oldfunclimits = dnvlist_get_nvlist(oldlimits,
LIMIT_NV_ADDR2NAME, NULL);
LIMIT_NV_NAME2ADDR, NULL);
}
cookie = NULL;

12
lib/libcasper/services/cap_net/tests/net_test.c
View file

@ -783,6 +783,18 @@ ATF_TC_BODY(capnet__limits_name2addr_hosts, tc)
limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR);
ATF_REQUIRE(cap_net_limit(limit) != 0);
/* Try to extend the limit. */
limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR);
ATF_REQUIRE(limit != NULL);
cap_net_limit_name2addr(limit, TEST_DOMAIN_1, NULL);
ATF_REQUIRE(cap_net_limit(limit) != 0);
limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR);
ATF_REQUIRE(limit != NULL);
cap_net_limit_name2addr(limit, TEST_DOMAIN_0, NULL);
cap_net_limit_name2addr(limit, TEST_DOMAIN_1, NULL);
ATF_REQUIRE(cap_net_limit(limit) != 0);
cap_close(capnet);
}