https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=207975
Bug ID: 207975
Summary: mac_bsdextended allows renaming and moving, when it
should not (after commit 272130)
Product: Base System
Version: 11.0-CURRENT
Hardware: Any
OS: Any
Status: New
Severity: Affects Some People
Priority: ---
Component: kern
Assignee: freebsd-bugs@FreeBSD.org
Reporter: cej...@fit.vutbr.cz
After commit 272130
(https://lists.freebsd.org/pipermail/svn-src-head/2014-September/062990.html),
mac_bsdextended allows renaming and moving, when it should not. Unfortunately,
the change is rather old, so the same problem is in 10-STABLE already too.
Quick test (change "user" to your favorite login in you system):
# kldload mac_bsdextended
# ugidfw add subject uid user object type l mode rs
# su - user
$ ln -s src dst
$ rm -v dst
rm: dst: Permission denied # correct
$ mv -v dst dst2
dst -> dst2 # incorrect, it should be permission denied
$ exit
#
You can look into sys/security/mac_bsdextended/ugidfw_vnode.c, functions
ugidfw_vnode_check_rename_from() and ugidfw_vnode_check_unlink() - the codes
are the same, but behavior is different. Before 272130, it really worked and mv
was not possible, so probably change 272130 changed behavior, so that
ugidfw_vnode_check_rename_from() is not called for rename operation anymore?
--
You are receiving this mail because:
You are the assignee for the bug.
_______________________________________________
freebsd-bugs@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-bugs
To unsubscribe, send any mail to "freebsd-bugs-unsubscr...@freebsd.org"
