hardenedbsd/HardenedBSD
1
0
Fork 0
mirror of https://git.hardenedbsd.org/hardenedbsd/HardenedBSD.git synced 2024-11-22 03:04:34 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

ktrace: Record cpuset violations with KTR_CAPFAIL

Browse Source 
Report Capsicum violations in the cpuset namespace with CAPFAIL_CPUSET.

Reviewed by:	markj
Approved by:	markj (mentor)
MFC after:	1 month
Differential Revision:	https://reviews.freebsd.org/D40677
This commit is contained in:
Jake Freeland 2024-04-06 13:31:14 -05:00
parent 9bec841312
commit 96c8b3e509
1 changed files with 28 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

40
sys/kern/kern_cpuset.c
View File

@ -1762,22 +1762,38 @@ cpuset_setproc_update_set(struct proc *p, struct cpuset *set)
* In Capability mode, the only accesses that are permitted are to the current
* thread and process' CPU and domain sets.
*/
static bool
cpuset_capmode_allowed(struct thread *td, cpulevel_t level, cpuwhich_t which,
id_t id)
{
if (level != CPU_LEVEL_WHICH)
return (false);
if (which != CPU_WHICH_TID && which != CPU_WHICH_PID &&
which != CPU_WHICH_TIDPID)
return (false);
if (id != -1 && which == CPU_WHICH_TIDPID &&
id != td->td_tid && id != td->td_proc->p_pid)
return (false);
if (id != -1 &&
!(which == CPU_WHICH_TID && id == td->td_tid) &&
!(which == CPU_WHICH_PID && id == td->td_proc->p_pid))
return (false);
return (true);
}
/*
* Check for capability violations and record them if ktrace(2) is active.
*/
static int
cpuset_check_capabilities(struct thread *td, cpulevel_t level, cpuwhich_t which,
id_t id)
{
if (IN_CAPABILITY_MODE(td)) {
if (level != CPU_LEVEL_WHICH)
return (ECAPMODE);
if (which != CPU_WHICH_TID && which != CPU_WHICH_PID &&
which != CPU_WHICH_TIDPID)
return (ECAPMODE);
if (id != -1 && which == CPU_WHICH_TIDPID &&
id != td->td_tid && id != td->td_proc->p_pid)
return (ECAPMODE);
if (id != -1 &&
!(which == CPU_WHICH_TID && id == td->td_tid) &&
!(which == CPU_WHICH_PID && id == td->td_proc->p_pid))
if (IN_CAPABILITY_MODE(td) || CAP_TRACING(td)) {
if (cpuset_capmode_allowed(td, level, which, id))
return (0);
if (CAP_TRACING(td))
ktrcapfail(CAPFAIL_CPUSET, NULL);
if (IN_CAPABILITY_MODE(td))
return (ECAPMODE);
}
return (0);