mirror of
https://github.com/freebsd/freebsd-src
synced 2024-10-15 12:54:27 +00:00
cap_net: correct capability name from addr2name to name2addr
Previously, while checking name2addr capabilities, we mistakenly used the addr2name set. This error could cause a process to inadvertently reset its limitations. Reported by: Shawn Webb <shawn.webb@hardenedbsd.org>
This commit is contained in:
parent
934a24e55a
commit
afd74c4000
|
@ -1232,7 +1232,7 @@ verify_name2addr_newlimits(const nvlist_t *oldlimits,
|
||||||
oldfunclimits = NULL;
|
oldfunclimits = NULL;
|
||||||
if (oldlimits != NULL) {
|
if (oldlimits != NULL) {
|
||||||
oldfunclimits = dnvlist_get_nvlist(oldlimits,
|
oldfunclimits = dnvlist_get_nvlist(oldlimits,
|
||||||
LIMIT_NV_ADDR2NAME, NULL);
|
LIMIT_NV_NAME2ADDR, NULL);
|
||||||
}
|
}
|
||||||
|
|
||||||
cookie = NULL;
|
cookie = NULL;
|
||||||
|
|
|
@ -783,6 +783,18 @@ ATF_TC_BODY(capnet__limits_name2addr_hosts, tc)
|
||||||
limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR);
|
limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR);
|
||||||
ATF_REQUIRE(cap_net_limit(limit) != 0);
|
ATF_REQUIRE(cap_net_limit(limit) != 0);
|
||||||
|
|
||||||
|
/* Try to extend the limit. */
|
||||||
|
limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR);
|
||||||
|
ATF_REQUIRE(limit != NULL);
|
||||||
|
cap_net_limit_name2addr(limit, TEST_DOMAIN_1, NULL);
|
||||||
|
ATF_REQUIRE(cap_net_limit(limit) != 0);
|
||||||
|
|
||||||
|
limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR);
|
||||||
|
ATF_REQUIRE(limit != NULL);
|
||||||
|
cap_net_limit_name2addr(limit, TEST_DOMAIN_0, NULL);
|
||||||
|
cap_net_limit_name2addr(limit, TEST_DOMAIN_1, NULL);
|
||||||
|
ATF_REQUIRE(cap_net_limit(limit) != 0);
|
||||||
|
|
||||||
cap_close(capnet);
|
cap_close(capnet);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
Loading…
Reference in a new issue