Module Name: src
Committed By: elad
Date: Sat Oct 3 00:14:07 UTC 2009
Modified Files:
src/sys/kern: kern_event.c
src/sys/secmodel/suser: secmodel_suser.c
Log Message:
Move kevent policy back to the subsystem.
To generate a diff of this commit:
cvs rdiff -u -r1.65 -r1.66 src/sys/kern/kern_event.c
cvs rdiff -u -r1.15 -r1.16 src/sys/secmodel/suser/secmodel_suser.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/kern/kern_event.c
diff -u src/sys/kern/kern_event.c:1.65 src/sys/kern/kern_event.c:1.66
--- src/sys/kern/kern_event.c:1.65 Sun May 24 21:41:26 2009
+++ src/sys/kern/kern_event.c Sat Oct 3 00:14:07 2009
@@ -1,4 +1,4 @@
-/* $NetBSD: kern_event.c,v 1.65 2009/05/24 21:41:26 ad Exp $ */
+/* $NetBSD: kern_event.c,v 1.66 2009/10/03 00:14:07 elad Exp $ */
/*-
* Copyright (c) 2008, 2009 The NetBSD Foundation, Inc.
@@ -58,7 +58,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: kern_event.c,v 1.65 2009/05/24 21:41:26 ad Exp $");
+__KERNEL_RCSID(0, "$NetBSD: kern_event.c,v 1.66 2009/10/03 00:14:07 elad Exp $");
#include <sys/param.h>
#include <sys/systm.h>
@@ -173,6 +173,30 @@
static krwlock_t kqueue_filter_lock; /* lock on filter lists */
static kmutex_t kqueue_misc_lock; /* miscellaneous */
+static kauth_listener_t kqueue_listener;
+
+static int
+kqueue_listener_cb(kauth_cred_t cred, kauth_action_t action, void *cookie,
+ void *arg0, void *arg1, void *arg2, void *arg3)
+{
+ struct proc *p;
+ int result;
+
+ result = KAUTH_RESULT_DEFER;
+ p = arg0;
+
+ if (action != KAUTH_PROCESS_KEVENT_FILTER)
+ return result;
+
+ if ((kauth_cred_getuid(p->p_cred) != kauth_cred_getuid(cred) ||
+ ISSET(p->p_flag, PK_SUGID)))
+ return result;
+
+ result = KAUTH_RESULT_ALLOW;
+
+ return result;
+}
+
/*
* Initialize the kqueue subsystem.
*/
@@ -182,6 +206,9 @@
rw_init(&kqueue_filter_lock);
mutex_init(&kqueue_misc_lock, MUTEX_DEFAULT, IPL_NONE);
+
+ kqueue_listener = kauth_listen_scope(KAUTH_SCOPE_PROCESS,
+ kqueue_listener_cb, NULL);
}
/*
Index: src/sys/secmodel/suser/secmodel_suser.c
diff -u src/sys/secmodel/suser/secmodel_suser.c:1.15 src/sys/secmodel/suser/secmodel_suser.c:1.16
--- src/sys/secmodel/suser/secmodel_suser.c:1.15 Sat Oct 3 00:06:37 2009
+++ src/sys/secmodel/suser/secmodel_suser.c Sat Oct 3 00:14:07 2009
@@ -1,4 +1,4 @@
-/* $NetBSD: secmodel_suser.c,v 1.15 2009/10/03 00:06:37 elad Exp $ */
+/* $NetBSD: secmodel_suser.c,v 1.16 2009/10/03 00:14:07 elad Exp $ */
/*-
* Copyright (c) 2006 Elad Efrat <e...@netbsd.org>
* All rights reserved.
@@ -38,7 +38,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: secmodel_suser.c,v 1.15 2009/10/03 00:06:37 elad Exp $");
+__KERNEL_RCSID(0, "$NetBSD: secmodel_suser.c,v 1.16 2009/10/03 00:14:07 elad Exp $");
#include <sys/types.h>
#include <sys/param.h>
@@ -591,12 +591,7 @@
}
case KAUTH_PROCESS_KEVENT_FILTER:
- if ((kauth_cred_getuid(p->p_cred) !=
- kauth_cred_getuid(cred) ||
- ISSET(p->p_flag, PK_SUGID)) &&
- !isroot)
- break;
- else
+ if (isroot)
result = KAUTH_RESULT_ALLOW;
break;
