svn commit: r208708 - projects/capabilities8/sys/kern

[Robert Watson]

Author: rwatson
Date: Tue Jun  1 15:01:02 2010
New Revision: 208708
URL: http://svn.freebsd.org/changeset/base/208708

Log:
  Merge r178261 from the p4 TrustedBSD capabilities branch to capabilities8:
  
    Allow fstatat() in capability mode.
  
  Submitted by:	jona

Modified:
  projects/capabilities8/sys/kern/capabilities.conf
  projects/capabilities8/sys/kern/init_sysent.c
  projects/capabilities8/sys/kern/vfs_syscalls.c

Modified: projects/capabilities8/sys/kern/capabilities.conf
==============================================================================
--- projects/capabilities8/sys/kern/capabilities.conf	Tue Jun  1 14:54:50 2010	(r208707)
+++ projects/capabilities8/sys/kern/capabilities.conf	Tue Jun  1 15:01:02 2010	(r208708)
@@ -38,7 +38,7 @@
 ## - sys_exit(2), abort2(2) and close(2) are very important.
 ## - Sorted alphabetically, please keep it that way.
 ##
-## $P4: //depot/projects/trustedbsd/capabilities/src/sys/kern/capabilities.conf#26 $
+## $P4: //depot/projects/trustedbsd/capabilities/src/sys/kern/capabilities.conf#27 $
 ##
 
 ##
@@ -457,6 +457,7 @@ olio_listio
 ## files which are not "under" the directory FD given to the syscall.
 ##
 faccessat
+fstatat
 fchmodat
 futimesat
 mkdirat

Modified: projects/capabilities8/sys/kern/init_sysent.c
==============================================================================
--- projects/capabilities8/sys/kern/init_sysent.c	Tue Jun  1 14:54:50 2010	(r208707)
+++ projects/capabilities8/sys/kern/init_sysent.c	Tue Jun  1 15:01:02 2010	(r208708)
@@ -527,7 +527,7 @@ struct sysent sysent[] = {
 	{ AS(fchmodat_args), (sy_call_t *)fchmodat, AUE_FCHMODAT, NULL, 0, 0, SYF_CAPENABLED },	/* 490 = fchmodat */
 	{ AS(fchownat_args), (sy_call_t *)fchownat, AUE_FCHOWNAT, NULL, 0, 0, 0 },	/* 491 = fchownat */
 	{ AS(fexecve_args), (sy_call_t *)fexecve, AUE_FEXECVE, NULL, 0, 0, SYF_CAPENABLED },	/* 492 = fexecve */
-	{ AS(fstatat_args), (sy_call_t *)fstatat, AUE_FSTATAT, NULL, 0, 0, 0 },	/* 493 = fstatat */
+	{ AS(fstatat_args), (sy_call_t *)fstatat, AUE_FSTATAT, NULL, 0, 0, SYF_CAPENABLED },	/* 493 = fstatat */
 	{ AS(futimesat_args), (sy_call_t *)futimesat, AUE_FUTIMESAT, NULL, 0, 0, SYF_CAPENABLED },	/* 494 = futimesat */
 	{ AS(linkat_args), (sy_call_t *)linkat, AUE_LINKAT, NULL, 0, 0, 0 },	/* 495 = linkat */
 	{ AS(mkdirat_args), (sy_call_t *)mkdirat, AUE_MKDIRAT, NULL, 0, 0, SYF_CAPENABLED },	/* 496 = mkdirat */

Modified: projects/capabilities8/sys/kern/vfs_syscalls.c
==============================================================================
--- projects/capabilities8/sys/kern/vfs_syscalls.c	Tue Jun  1 14:54:50 2010	(r208707)
+++ projects/capabilities8/sys/kern/vfs_syscalls.c	Tue Jun  1 15:01:02 2010	(r208708)
@@ -2425,9 +2425,9 @@ kern_statat_vnhook(struct thread *td, in
 	if (flag & ~AT_SYMLINK_NOFOLLOW)
 		return (EINVAL);
 
-	NDINIT_AT(&nd, LOOKUP, ((flag & AT_SYMLINK_NOFOLLOW) ? NOFOLLOW :
+	NDINIT_ATRIGHTS(&nd, LOOKUP, ((flag & AT_SYMLINK_NOFOLLOW) ? NOFOLLOW :
 	    FOLLOW) | LOCKSHARED | LOCKLEAF | AUDITVNODE1 | MPSAFE, pathseg,
-	    path, fd, td);
+	    path, fd, CAP_FSTAT | CAP_ATBASE, td);
 
 	if ((error = namei(&nd)) != 0)
 		return (error);