Sat Oct 3 03:59:39 2009 UTC ()
Move KAUTH_NETWORK_BIND::KAUTH_REQ_NETWORK_BIND_PORT policy back to the
subsystem (or close to it).

Note: Revisit KAUTH_REQ_NETWORK_BIND_PRIVPORT.


(elad)
diff -r1.192 -r1.193 src/sys/kern/uipc_socket.c
diff -r1.25 -r1.26 src/sys/secmodel/suser/secmodel_suser.c
cvs diff -r1.192 -r1.193 src/sys/kern/uipc_socket.c (expand / switch to unified diff)

--- src/sys/kern/uipc_socket.c 2009/10/03 01:41:39 1.192
+++ src/sys/kern/uipc_socket.c 2009/10/03 03:59:39 1.193
@@ -1,14 +1,14 @@ @@ -1,14 +1,14 @@
1/* $NetBSD: uipc_socket.c,v 1.192 2009/10/03 01:41:39 elad Exp $ */ 1/* $NetBSD: uipc_socket.c,v 1.193 2009/10/03 03:59:39 elad Exp $ */
2 2
3/*- 3/*-
4 * Copyright (c) 2002, 2007, 2008, 2009 The NetBSD Foundation, Inc. 4 * Copyright (c) 2002, 2007, 2008, 2009 The NetBSD Foundation, Inc.
5 * All rights reserved. 5 * All rights reserved.
6 * 6 *
7 * This code is derived from software contributed to The NetBSD Foundation 7 * This code is derived from software contributed to The NetBSD Foundation
8 * by Jason R. Thorpe of Wasabi Systems, Inc, and by Andrew Doran. 8 * by Jason R. Thorpe of Wasabi Systems, Inc, and by Andrew Doran.
9 * 9 *
10 * Redistribution and use in source and binary forms, with or without 10 * Redistribution and use in source and binary forms, with or without
11 * modification, are permitted provided that the following conditions 11 * modification, are permitted provided that the following conditions
12 * are met: 12 * are met:
13 * 1. Redistributions of source code must retain the above copyright 13 * 1. Redistributions of source code must retain the above copyright
14 * notice, this list of conditions and the following disclaimer. 14 * notice, this list of conditions and the following disclaimer.
@@ -53,27 +53,27 @@ @@ -53,27 +53,27 @@
53 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 53 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
54 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 54 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
55 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 55 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
56 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 56 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
57 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 57 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
58 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 58 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
59 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 59 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
60 * SUCH DAMAGE. 60 * SUCH DAMAGE.
61 * 61 *
62 * @(#)uipc_socket.c 8.6 (Berkeley) 5/2/95 62 * @(#)uipc_socket.c 8.6 (Berkeley) 5/2/95
63 */ 63 */
64 64
65#include <sys/cdefs.h> 65#include <sys/cdefs.h>
66__KERNEL_RCSID(0, "$NetBSD: uipc_socket.c,v 1.192 2009/10/03 01:41:39 elad Exp $"); 66__KERNEL_RCSID(0, "$NetBSD: uipc_socket.c,v 1.193 2009/10/03 03:59:39 elad Exp $");
67 67
68#include "opt_compat_netbsd.h" 68#include "opt_compat_netbsd.h"
69#include "opt_sock_counters.h" 69#include "opt_sock_counters.h"
70#include "opt_sosend_loan.h" 70#include "opt_sosend_loan.h"
71#include "opt_mbuftrace.h" 71#include "opt_mbuftrace.h"
72#include "opt_somaxkva.h" 72#include "opt_somaxkva.h"
73#include "opt_multiprocessor.h" /* XXX */ 73#include "opt_multiprocessor.h" /* XXX */
74 74
75#include <sys/param.h> 75#include <sys/param.h>
76#include <sys/systm.h> 76#include <sys/systm.h>
77#include <sys/proc.h> 77#include <sys/proc.h>
78#include <sys/file.h> 78#include <sys/file.h>
79#include <sys/filedesc.h> 79#include <sys/filedesc.h>
@@ -430,30 +430,35 @@ getsombuf(struct socket *so, int type) @@ -430,30 +430,35 @@ getsombuf(struct socket *so, int type)
430 return m; 430 return m;
431} 431}
432 432
433static int 433static int
434socket_listener_cb(kauth_cred_t cred, kauth_action_t action, void *cookie, 434socket_listener_cb(kauth_cred_t cred, kauth_action_t action, void *cookie,
435 void *arg0, void *arg1, void *arg2, void *arg3) 435 void *arg0, void *arg1, void *arg2, void *arg3)
436{ 436{
437 int result; 437 int result;
438 enum kauth_network_req req; 438 enum kauth_network_req req;
439 439
440 result = KAUTH_RESULT_DEFER; 440 result = KAUTH_RESULT_DEFER;
441 req = (enum kauth_network_req)arg0; 441 req = (enum kauth_network_req)arg0;
442 442
443 if (action != KAUTH_NETWORK_SOCKET) 443 if ((action != KAUTH_NETWORK_SOCKET) &&
 444 (action != KAUTH_NETWORK_BIND))
444 return result; 445 return result;
445 446
446 switch (req) { 447 switch (req) {
 448 case KAUTH_REQ_NETWORK_BIND_PORT:
 449 result = KAUTH_RESULT_ALLOW;
 450 break;
 451
447 case KAUTH_REQ_NETWORK_SOCKET_DROP: { 452 case KAUTH_REQ_NETWORK_SOCKET_DROP: {
448 /* Normal users can only drop their own connections. */ 453 /* Normal users can only drop their own connections. */
449 struct socket *so = (struct socket *)arg1; 454 struct socket *so = (struct socket *)arg1;
450 uid_t sockuid = so->so_uidinfo->ui_uid; 455 uid_t sockuid = so->so_uidinfo->ui_uid;
451 456
452 if (sockuid == kauth_cred_getuid(cred) || 457 if (sockuid == kauth_cred_getuid(cred) ||
453 sockuid == kauth_cred_geteuid(cred)) 458 sockuid == kauth_cred_geteuid(cred))
454 result = KAUTH_RESULT_ALLOW; 459 result = KAUTH_RESULT_ALLOW;
455 460
456 break; 461 break;
457 } 462 }
458 463
459 case KAUTH_REQ_NETWORK_SOCKET_OPEN: 464 case KAUTH_REQ_NETWORK_SOCKET_OPEN:
cvs diff -r1.25 -r1.26 src/sys/secmodel/suser/secmodel_suser.c (expand / switch to unified diff)

--- src/sys/secmodel/suser/secmodel_suser.c 2009/10/03 03:38:31 1.25
+++ src/sys/secmodel/suser/secmodel_suser.c 2009/10/03 03:59:39 1.26
@@ -1,14 +1,14 @@ @@ -1,14 +1,14 @@
1/* $NetBSD: secmodel_suser.c,v 1.25 2009/10/03 03:38:31 elad Exp $ */ 1/* $NetBSD: secmodel_suser.c,v 1.26 2009/10/03 03:59:39 elad Exp $ */
2/*- 2/*-
3 * Copyright (c) 2006 Elad Efrat <elad@NetBSD.org> 3 * Copyright (c) 2006 Elad Efrat <elad@NetBSD.org>
4 * All rights reserved. 4 * All rights reserved.
5 * 5 *
6 * Redistribution and use in source and binary forms, with or without 6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions 7 * modification, are permitted provided that the following conditions
8 * are met: 8 * are met:
9 * 1. Redistributions of source code must retain the above copyright 9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer. 10 * notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright 11 * 2. Redistributions in binary form must reproduce the above copyright
12 * notice, this list of conditions and the following disclaimer in the 12 * notice, this list of conditions and the following disclaimer in the
13 * documentation and/or other materials provided with the distribution. 13 * documentation and/or other materials provided with the distribution.
14 * 3. The name of the author may not be used to endorse or promote products 14 * 3. The name of the author may not be used to endorse or promote products
@@ -28,27 +28,27 @@ @@ -28,27 +28,27 @@
28 28
29/* 29/*
30 * This file contains kauth(9) listeners needed to implement the traditional 30 * This file contains kauth(9) listeners needed to implement the traditional
31 * NetBSD superuser access restrictions. 31 * NetBSD superuser access restrictions.
32 * 32 *
33 * There are two main resources a request can be issued to: user-owned and 33 * There are two main resources a request can be issued to: user-owned and
34 * system owned. For the first, traditional Unix access checks are done, as 34 * system owned. For the first, traditional Unix access checks are done, as
35 * well as superuser checks. If needed, the request context is examined before 35 * well as superuser checks. If needed, the request context is examined before
36 * a decision is made. For the latter, usually only superuser checks are done 36 * a decision is made. For the latter, usually only superuser checks are done
37 * as normal users are not allowed to access system resources. 37 * as normal users are not allowed to access system resources.
38 */ 38 */
39 39
40#include <sys/cdefs.h> 40#include <sys/cdefs.h>
41__KERNEL_RCSID(0, "$NetBSD: secmodel_suser.c,v 1.25 2009/10/03 03:38:31 elad Exp $"); 41__KERNEL_RCSID(0, "$NetBSD: secmodel_suser.c,v 1.26 2009/10/03 03:59:39 elad Exp $");
42 42
43#include <sys/types.h> 43#include <sys/types.h>
44#include <sys/param.h> 44#include <sys/param.h>
45#include <sys/kauth.h> 45#include <sys/kauth.h>
46 46
47#include <sys/mutex.h> 47#include <sys/mutex.h>
48#include <sys/mount.h> 48#include <sys/mount.h>
49#include <sys/socketvar.h> 49#include <sys/socketvar.h>
50#include <sys/sysctl.h> 50#include <sys/sysctl.h>
51#include <sys/vnode.h> 51#include <sys/vnode.h>
52#include <sys/proc.h> 52#include <sys/proc.h>
53#include <sys/uidinfo.h> 53#include <sys/uidinfo.h>
54#include <sys/module.h> 54#include <sys/module.h>
@@ -601,30 +601,26 @@ secmodel_suser_network_cb(kauth_cred_t c @@ -601,30 +601,26 @@ secmodel_suser_network_cb(kauth_cred_t c
601 case KAUTH_REQ_NETWORK_ALTQ_WFQ: 601 case KAUTH_REQ_NETWORK_ALTQ_WFQ:
602 if (isroot) 602 if (isroot)
603 result = KAUTH_RESULT_ALLOW; 603 result = KAUTH_RESULT_ALLOW;
604 break; 604 break;
605 605
606 default: 606 default:
607 break; 607 break;
608 } 608 }
609 609
610 break; 610 break;
611 611
612 case KAUTH_NETWORK_BIND: 612 case KAUTH_NETWORK_BIND:
613 switch (req) { 613 switch (req) {
614 case KAUTH_REQ_NETWORK_BIND_PORT: 
615 result = KAUTH_RESULT_ALLOW; 
616 break; 
617 
618 case KAUTH_REQ_NETWORK_BIND_PRIVPORT: 614 case KAUTH_REQ_NETWORK_BIND_PRIVPORT:
619 if (isroot) 615 if (isroot)
620 result = KAUTH_RESULT_ALLOW; 616 result = KAUTH_RESULT_ALLOW;
621 break; 617 break;
622 618
623 default: 619 default:
624 break; 620 break;
625 } 621 }
626 break; 622 break;
627 623
628 case KAUTH_NETWORK_FORWSRCRT: 624 case KAUTH_NETWORK_FORWSRCRT:
629 case KAUTH_NETWORK_ROUTE: 625 case KAUTH_NETWORK_ROUTE:
630 if (isroot) 626 if (isroot)