Securing syslogd, reducing Chromium diffs with SO_PASSCRED

2021-09-27 Thread David MacKay
I want. Improving syslogd is obviously of interest to the OpenBSD project, so why not use the ability to determine the credentials and PID of a datagram's sender in some way? As a start, it could at least be useful to log it so that obvious discrepancies are visible. Kind regards, David Mackay

[PATCH] add SO_PASSCRED to receive creds of Unix datagram sender

2021-09-25 Thread David MacKay
for those. Kind regards, David Mackay diff --git sys/kern/uipc_socket.c sys/kern/uipc_socket.c index 6f3f2ce4b..37a46032b 100644 --- sys/kern/uipc_socket.c +++ sys/kern/uipc_socket.c @@ -1866,6 +1866,19 @@ sosetopt(struct socket *so, int level, int optname, struct mbuf *m

Re: Patch: Sending credentials over Unix datagram sockets

2020-03-18 Thread David Mackay
Claudio Jeker wrote: > I highly suspect that this is not correct without further changes. > There is a reason why the comment is explicit about the fact that it only > works if SCM_RIGHTS is the only control message type. Just ignoring this > fact is probably a security risk. Isn't the

Re: Patch: Sending credentials over Unix datagram sockets

2020-03-17 Thread David Mackay
GMail seems determined to ruin the formatting. Diff is now an attachment instead. -Original Message- From: David Mackay Sent: 18 March 2020 03:24 To: 'tech@openbsd.org' Subject: RE: Patch: Sending credentials over Unix datagram sockets Sorry, looks like my mail client mangled

Re: Patch: Sending credentials over Unix datagram sockets

2020-03-17 Thread David Mackay
the kernel encounters this, it fills out a struct cmsgcred containing PID, UID, GID, effective UID, and effective GIDs of the sender. This patch implements this for OpenBSD. Kind regards, David -Original Message- From: David Mackay Sent: 18 March 2020 02:53 To: 'tech@openbsd.org' Subject

Patch: Sending credentials over Unix datagram sockets

2020-03-17 Thread David Mackay
Dear openbsd-tech, On GNU HURD and FreeBSD, the control message SCM_CREDS may be allocated by a client of a Unix datagram socket. When the kernel encounters this, it fills out a struct cmsgcred containing PID, UID, GID, effective UID, and effective GIDs of the sender. This patch implements this