bindat(2) and connectat(2) syscalls for review.

[Pawel Jakub Dawidek]

On Thu, Feb 14, 2013 at 12:19:42AM +0100, Jilles Tjoelker wrote:
> On Thu, Feb 14, 2013 at 12:03:54AM +0100, Pawel Jakub Dawidek wrote:
> > I'd like to commit the following patch:
> 
> > 	http://people.freebsd.org/~pjd/patches/bindconnectat.patch
> 
> > It implements bindat(2) and connectat(2) syscalls that will allow to
> > manage UNIX domain sockets from within capability mode sandbox.
> 
> > They work just like any other *at(2) syscall and their prototypes look
> > like this:
> 
> > 	int bindat(int fd, int s, const struct sockaddr *addr, socklen_t addrlen);
> > 	int connectat(int fd, int s, const struct sockaddr *addr, socklen_t addrlen);
> 
> > Where 'fd' is directory descriptor. The only supported socket domain is
> > PF_LOCAL.
> 
> > The audit subsystem was updated to audit the new syscalls properly.
> 
> These calls are inherently limited to PF_LOCAL anyway, so why not go a
> bit further and accept a pathname instead of a struct sockaddr_un that
> has an arbitrary limit of 104 bytes? This appears possible because new
> usrreqs were created.

This is an interesting idea, which we discussed with Robert and the
conclusion is that struct sockaddr will stay. Moving to pathname is a
one-way street and we could imagine some, maybe odd, but possible
scenarious where 'fd' doesn't represent directory, but something else,
eg. a vimage-based network stack where other domains might be useful.
Capabilities in FreeBSD are very young and it seems better not to close
too many doors just yet.

As for the 104 bytes limit, this is of course not my intention to fix
the limit with those syscalls. While it would be a nice side-effect it
can't be a reason to select one approach over the other. Also using
directory descriptor as a starting point should help to use shorter
paths.

> Can the "XXXRW: Revisit this" comments before #bind and #connect in
> sys/kern/capabilities.conf go away now?

This is under discussion:)

-- 
Pawel Jakub Dawidek                       http://www.wheelsystems.com
FreeBSD committer                         http://www.FreeBSD.org
Am I Evil? Yes, I Am!                     http://tupytaj.pl
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 196 bytes
Desc: not available
URL: <http://lists.freebsd.org/pipermail/freebsd-arch/attachments/20130214/80a3a72f/attachment.sig>