hardenedbsd/HardenedBSD
1
0
Fork 0
mirror of https://git.hardenedbsd.org/hardenedbsd/HardenedBSD.git synced 2025-01-01 00:18:15 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

Add a sysctl to control if argv is disclosed to the world:

Browse Source 
kern.ps_argsopen
It defaults to 1 which means that all users can see all argvs in ps(1).

Reviewed by:	Warner
This commit is contained in:
Poul-Henning Kamp 1999-11-26 08:27:16 +00:00
parent 0f59fe37a4
commit a8704f8999
5 changed files with 7 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
sys/fs/procfs/procfs_status.c
View File

@ -183,7 +183,7 @@ procfs_docmdline(curp, p, pfs, uio)
* Linux behaviour is to return zero-length in this case.
*/
if (p->p_args && !p_trespass(curp, p)) {
if (p->p_args && (ps_argsopen ||!p_trespass(curp, p))) {
bp = p->p_args->ar_args;
buflen = p->p_args->ar_length;
buf = 0;

3
sys/kern/kern_exec.c
View File

@ -77,6 +77,9 @@ u_long ps_arg_cache_limit = PAGE_SIZE / 16;
SYSCTL_LONG(_kern, OID_AUTO, ps_arg_cache_limit, CTLFLAG_RW,
&ps_arg_cache_limit, "");
int ps_argsopen = 1;
SYSCTL_INT(_kern, OID_AUTO, ps_argsopen, CTLFLAG_RW, &ps_argsopen, 0, "");
/*
* Each of the items is a pointer to a `const struct execsw', hence the
* double pointer here.

2
sys/kern/kern_proc.c
View File

@ -633,7 +633,7 @@ sysctl_kern_proc_args SYSCTL_HANDLER_ARGS
if (!p)
return (0);
if (p_trespass(curproc, p))
if ((!ps_argsopen) && p_trespass(curproc, p))
return (0);
if (req->newptr && curproc != p)

2
sys/miscfs/procfs/procfs_status.c
View File

@ -183,7 +183,7 @@ procfs_docmdline(curp, p, pfs, uio)
* Linux behaviour is to return zero-length in this case.
*/
if (p->p_args && !p_trespass(curp, p)) {
if (p->p_args && (ps_argsopen ||!p_trespass(curp, p))) {
bp = p->p_args->ar_args;
buflen = p->p_args->ar_length;
buf = 0;

1
sys/sys/proc.h
View File

@ -384,6 +384,7 @@ extern int whichrtqs; /* Bit mask summary of non-empty Q's. */
extern int whichidqs; /* Bit mask summary of non-empty Q's. */
extern u_long ps_arg_cache_limit;
extern int ps_argsopen;
struct proc *pfind __P((pid_t)); /* Find process by id. */
struct pgrp *pgfind __P((pid_t)); /* Find process group by id. */