https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=222258
Conrad Meyer <c...@freebsd.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |rwat...@freebsd.org
--- Comment #1 from Conrad Meyer <c...@freebsd.org> ---
This is a little odd. The kernel implementation of rename(2) just invokes
kern_renameat() with AT_FDCWD, like renameat() with AT_FDCWD. But perhaps Perl
in *at() mode uses fds other than AT_FDCWD.
Looking at namei() and sys_capability.c, I don't see where we ever check if a
thread is sandboxed or not. It seems like something like this might be needed,
although I'm not sure if it is sufficient:
--- a/sys/kern/kern_descrip.c
+++ b/sys/kern/kern_descrip.c
@@ -2492,9 +2492,11 @@ fget_cap_locked(struct filedesc *fdp, int fd,
cap_rights_t *needrightsp,
}
#ifdef CAPABILITIES
- error = cap_check(cap_rights_fde(fde), needrightsp);
- if (error != 0)
- goto out;
+ if (IN_CAPABILITY_MODE(curthread)) {
+ error = cap_check(cap_rights_fde(fde), needrightsp);
+ if (error != 0)
+ goto out;
+ }
#endif
if (havecapsp != NULL)
@@ -2593,9 +2595,11 @@ fget_unlocked(struct filedesc *fdp, int fd, cap_rights_t
*needrightsp,
if (fp == NULL)
return (EBADF);
#ifdef CAPABILITIES
- error = cap_check(&haverights, needrightsp);
- if (error != 0)
- return (error);
+ if (IN_CAPABILITY_MODE(curthread)) {
+ error = cap_check(&haverights, needrightsp);
+ if (error != 0)
+ return (error);
+ }
#endif
count = fp->f_count;
retry:
--
You are receiving this mail because:
You are the assignee for the bug.
_______________________________________________
freebsd-bugs@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-bugs
To unsubscribe, send any mail to "freebsd-bugs-unsubscr...@freebsd.org"
