Re: HEADS UP! IPC security (Re: cvs commit: src/sys/kern sysv_ipc.c(fwd))

2000-03-02 Thread Bruce Evans
On Thu, 2 Mar 2000, Brian Dean wrote: > Resisting the temptation to cut-and-paste (resulting in the lost > tabs), and incorporating your other suggestions, how about this > version? > > Index: sysv_ipc.c > === > RCS file: /usr00/mir

Re: HEADS UP! IPC security (Re: cvs commit: src/sys/kern sysv_ipc.c(fwd))

2000-03-02 Thread Brian Dean
Bruce Evans wrote: > It has too many style bugs for me. It corrupts all tabs to spaces and > has some other style bugs. Resisting the temptation to cut-and-paste (resulting in the lost tabs), and incorporating your other suggestions, how about this version? Thanks, -Brian Index: sysv_ipc.c ===

Re: HEADS UP! IPC security (Re: cvs commit: src/sys/kern sysv_ipc.c(fwd))

2000-03-02 Thread Bruce Evans
On Thu, 2 Mar 2000, Brian Dean wrote: > I believe the following patch does what you are asking. Essentially, > it only calls suser() if it was about to return a permission error, > thus the ASU flag should only be set when superuser privileges are > actually used. > > Let me know if this looks

Re: HEADS UP! IPC security (Re: cvs commit: src/sys/kern sysv_ipc.c(fwd))

2000-03-02 Thread Brian Dean
Bruce Evans wrote: > It had rotted further since then (as half threatened in rev.1.9) to > passing the process pointer so that it can mess up p->p_acflag. This > results in the ASU flag always being set in p->p_acflag for root, > although no special privilege is required for root to operate on ip

Re: HEADS UP! IPC security (Re: cvs commit: src/sys/kern sysv_ipc.c(fwd))

2000-03-01 Thread Bruce Evans
> -- Forwarded message -- > Date: Wed, 1 Mar 2000 21:03:22 -0500 (EST) > From: Brian Dean <[EMAIL PROTECTED]> > To: [EMAIL PROTECTED] > Cc: [EMAIL PROTECTED] > Subject: Re: cvs commit: src/sys/kern sysv_ipc.c > > [SNIP - KK] > > The bug is very easily tested/verified: just create

HEADS UP! IPC security (Re: cvs commit: src/sys/kern sysv_ipc.c(fwd))

2000-03-01 Thread Kris Kennaway
4.0 had a security bug which would let any user EXCEPT root delete a SYSV semaphore (the sense of a test was reversed). No other releases were affected - rebuild your kernels if this is an issue. Good catch, Brian! For "revision 1.8" in the below read "revision 1.9" (Jan 30, 1999). -- Fo