Author: pjd
Date: Wed Jul 3 22:18:40 2013
New Revision: 252630
URL: http://svnweb.freebsd.org/changeset/base/252630
Log:
MFp4 @229484:
Limit routing socket so only poll(2) and read(2) are allowed (CAP_POLL_EVENT
and CAP_READ). This prevents unprivileged process from adding, removing or
modifying system routes.
Reviewed by: brooks
Sponsored by: The FreeBSD Foundation
Modified:
head/sbin/dhclient/dhclient.c
Modified: head/sbin/dhclient/dhclient.c
==============================================================================
--- head/sbin/dhclient/dhclient.c Wed Jul 3 22:17:29 2013
(r252629)
+++ head/sbin/dhclient/dhclient.c Wed Jul 3 22:18:40 2013
(r252630)
@@ -492,6 +492,10 @@ main(int argc, char *argv[])
add_protocol("AF_ROUTE", routefd, routehandler, ifi);
if (shutdown(routefd, SHUT_WR) < 0)
error("can't shutdown route socket: %m");
+ if (cap_rights_limit(routefd, CAP_POLL_EVENT | CAP_READ) < 0 &&
+ errno != ENOSYS) {
+ error("can't limit route socket: %m");
+ }
if (chroot(_PATH_VAREMPTY) == -1)
error("chroot");
_______________________________________________
svn-src-all@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"
