Module Name: src
Committed By: chs
Date: Wed Nov 4 01:37:55 UTC 2020
Modified Files:
src/usr.bin/pmap: main.c pmap.c pmap.h
Log Message:
Restrict to root any command option that prints kernel addresses.
To generate a diff of this commit:
cvs rdiff -u -r1.28 -r1.29 src/usr.bin/pmap/main.c
cvs rdiff -u -r1.55 -r1.56 src/usr.bin/pmap/pmap.c
cvs rdiff -u -r1.12 -r1.13 src/usr.bin/pmap/pmap.h
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/usr.bin/pmap/main.c
diff -u src/usr.bin/pmap/main.c:1.28 src/usr.bin/pmap/main.c:1.29
--- src/usr.bin/pmap/main.c:1.28 Sun Mar 22 14:41:32 2020
+++ src/usr.bin/pmap/main.c Wed Nov 4 01:37:55 2020
@@ -1,4 +1,4 @@
-/* $NetBSD: main.c,v 1.28 2020/03/22 14:41:32 ad Exp $ */
+/* $NetBSD: main.c,v 1.29 2020/11/04 01:37:55 chs Exp $ */
/*
* Copyright (c) 2002, 2003, 2020 The NetBSD Foundation, Inc.
@@ -31,7 +31,7 @@
#include <sys/cdefs.h>
#ifndef lint
-__RCSID("$NetBSD: main.c,v 1.28 2020/03/22 14:41:32 ad Exp $");
+__RCSID("$NetBSD: main.c,v 1.29 2020/11/04 01:37:55 chs Exp $");
#endif
#include <sys/param.h>
@@ -121,6 +121,7 @@ main(int argc, char *argv[])
struct kbit kbit, *vmspace;
u_long address;
+ uid = getuid();
egid = getegid();
if (setegid(getgid()) == -1)
err(1, "failed to reset privileges");
@@ -231,11 +232,12 @@ main(int argc, char *argv[])
print_ddb == 0)
print_solaris = 1;
- /* get privs back if it appears to be safe, otherwise toss them */
- if (kernel == NULL && kmem == NULL && address == 0)
- rc = setegid(egid);
- else
- rc = setgid(getgid());
+ if ((kernel != NULL || kmem != NULL || address != 0 ||
+ print_ddb || debug) && uid != 0)
+ errx(1, "one or more options specified is restricted to root");
+
+ /* get privs back since it appears to be safe. */
+ rc = setegid(egid);
if (rc == -1)
err(1, "failed to reset privileges");
@@ -283,8 +285,6 @@ main(int argc, char *argv[])
exit(0);
}
- uid = getuid();
-
do {
if (pid == -1) {
if (argc == 0)
Index: src/usr.bin/pmap/pmap.c
diff -u src/usr.bin/pmap/pmap.c:1.55 src/usr.bin/pmap/pmap.c:1.56
--- src/usr.bin/pmap/pmap.c:1.55 Sun Mar 22 14:41:32 2020
+++ src/usr.bin/pmap/pmap.c Wed Nov 4 01:37:55 2020
@@ -1,4 +1,4 @@
-/* $NetBSD: pmap.c,v 1.55 2020/03/22 14:41:32 ad Exp $ */
+/* $NetBSD: pmap.c,v 1.56 2020/11/04 01:37:55 chs Exp $ */
/*
* Copyright (c) 2002, 2003, 2020 The NetBSD Foundation, Inc.
@@ -31,7 +31,7 @@
#include <sys/cdefs.h>
#ifndef lint
-__RCSID("$NetBSD: pmap.c,v 1.55 2020/03/22 14:41:32 ad Exp $");
+__RCSID("$NetBSD: pmap.c,v 1.56 2020/11/04 01:37:55 chs Exp $");
#endif
#include <string.h>
@@ -483,9 +483,7 @@ dump_vm_map_entry(kvm_t *kd, struct kinf
if (print_all) {
sz = (size_t)((vme->end - vme->start) / 1024);
- printf(A(vp) ?
- "%*s%0*"PRIxVADDR"-%0*"PRIxVADDR" %7luk %0*" PRIx64 " %c%c%c%c%c (%c%c%c) %d/%d/%d %02llu:%02llu %7llu - %s [%p]\n" :
- "%*s%0*"PRIxVADDR"-%0*"PRIxVADDR" %7luk %0*" PRIx64 " %c%c%c%c%c (%c%c%c) %d/%d/%d %02llu:%02llu %7llu - %s\n",
+ printf("%*s%0*"PRIxVADDR"-%0*"PRIxVADDR" %7luk %0*" PRIx64 " %c%c%c%c%c (%c%c%c) %d/%d/%d %02llu:%02llu %7llu - %s\n",
indent(2), "",
(int)sizeof(void *) * 2,
vme->start,
@@ -508,7 +506,7 @@ dump_vm_map_entry(kvm_t *kd, struct kinf
(unsigned long long)major(dev),
(unsigned long long)minor(dev),
(unsigned long long)inode,
- name, P(vp));
+ name);
}
/* no access allowed, don't count space */
Index: src/usr.bin/pmap/pmap.h
diff -u src/usr.bin/pmap/pmap.h:1.12 src/usr.bin/pmap/pmap.h:1.13
--- src/usr.bin/pmap/pmap.h:1.12 Sun Mar 22 14:41:32 2020
+++ src/usr.bin/pmap/pmap.h Wed Nov 4 01:37:55 2020
@@ -1,4 +1,4 @@
-/* $NetBSD: pmap.h,v 1.12 2020/03/22 14:41:32 ad Exp $ */
+/* $NetBSD: pmap.h,v 1.13 2020/11/04 01:37:55 chs Exp $ */
/*
* Copyright (c) 2002, 2003, 2020 The NetBSD Foundation, Inc.
@@ -98,8 +98,7 @@
((size_t)kvm_read((kd), (addr), (dst), (sz)) == (size_t)(sz))
#define _KDEREF(kd, addr, dst, sz) do { \
if (!_KDEREFOK((kd), (addr), (dst), (sz))) \
- errx(1, "trying to read %lu (%s) bytes from %lx: %s", \
- (unsigned long)(sz), #sz, (addr), kvm_geterr(kd)); \
+ errx(1, "reading from kmem failed: %s", kvm_geterr(kd)); \
} while (0/*CONSTCOND*/)
/* suck the data using the structure */
