hardenedbsd/HardenedBSD
1
0
Fork 0
mirror of https://git.hardenedbsd.org/hardenedbsd/HardenedBSD.git synced 2024-11-14 06:12:01 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

ktrace: Record socket violations with KTR_CAPFAIL

Browse Source 
Report restricted access to socket addresses and protocols while
Capsicum violation tracing with CAPFAIL_ADDR and CAPFAIL_PROTO.

Reviewed by:	markj
Approved by:	markj (mentor)
MFC after:	1 month
Differential Revision:	https://reviews.freebsd.org/D40681
This commit is contained in:
Jake Freeland 2024-04-06 13:31:28 -05:00
parent 0cd9cde767
commit aa32d7cbc9
2 changed files with 15 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
sys/kern/uipc_socket.c
View File

@ -104,6 +104,7 @@
#include "opt_inet.h"
#include "opt_inet6.h"
#include "opt_kern_tls.h"
#include "opt_ktrace.h"
#include "opt_sctp.h"
#include <sys/param.h>
@ -522,8 +523,12 @@ socreate(int dom, struct socket **aso, int type, int proto,
MPASS(prp->pr_attach);
if (IN_CAPABILITY_MODE(td) && (prp->pr_flags & PR_CAPATTACH) == 0)
return (ECAPMODE);
if ((prp->pr_flags & PR_CAPATTACH) == 0) {
if (CAP_TRACING(td))
ktrcapfail(CAPFAIL_PROTO, &proto);
if (IN_CAPABILITY_MODE(td))
return (ECAPMODE);
}
if (prison_check_af(cred, prp->pr_domain->dom_family) != 0)
return (EPROTONOSUPPORT);

13
sys/kern/uipc_syscalls.c
View File

@ -654,11 +654,6 @@ sendit(struct thread *td, int s, struct msghdr *mp, int flags)
struct sockaddr *to;
int error;
#ifdef CAPABILITY_MODE
if (IN_CAPABILITY_MODE(td) && (mp->msg_name != NULL))
return (ECAPMODE);
#endif
if (mp->msg_name != NULL) {
error = getsockaddr(&to, mp->msg_name, mp->msg_namelen);
if (error != 0) {
@ -666,6 +661,14 @@ sendit(struct thread *td, int s, struct msghdr *mp, int flags)
goto bad;
}
mp->msg_name = to;
#ifdef CAPABILITY_MODE
if (CAP_TRACING(td))
ktrcapfail(CAPFAIL_SOCKADDR, mp->msg_name);
if (IN_CAPABILITY_MODE(td)) {
error = ECAPMODE;
goto bad;
}
#endif
} else {
to = NULL;
}