[Bug 222258] renameat(2) capability error with absolute path names outside of a sandbox

[bugzilla-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=222258

Conrad Meyer <cem at freebsd.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |rwatson at FreeBSD.org

--- Comment #1 from Conrad Meyer <cem at freebsd.org> ---
This is a little odd.  The kernel implementation of rename(2) just invokes
kern_renameat() with AT_FDCWD, like renameat() with AT_FDCWD.  But perhaps Perl
in *at() mode uses fds other than AT_FDCWD.

Looking at namei() and sys_capability.c, I don't see where we ever check if a
thread is sandboxed or not.  It seems like something like this might be needed,
although I'm not sure if it is sufficient:

--- a/sys/kern/kern_descrip.c
+++ b/sys/kern/kern_descrip.c
@@ -2492,9 +2492,11 @@ fget_cap_locked(struct filedesc *fdp, int fd,
cap_rights_t *needrightsp,
        }

 #ifdef CAPABILITIES
-       error = cap_check(cap_rights_fde(fde), needrightsp);
-       if (error != 0)
-               goto out;
+       if (IN_CAPABILITY_MODE(curthread)) {
+               error = cap_check(cap_rights_fde(fde), needrightsp);
+               if (error != 0)
+                   goto out;
+       }
 #endif

        if (havecapsp != NULL)
@@ -2593,9 +2595,11 @@ fget_unlocked(struct filedesc *fdp, int fd, cap_rights_t
*needrightsp,
                if (fp == NULL)
                        return (EBADF);
 #ifdef CAPABILITIES
-               error = cap_check(&haverights, needrightsp);
-               if (error != 0)
-                       return (error);
+               if (IN_CAPABILITY_MODE(curthread)) {
+                       error = cap_check(&haverights, needrightsp);
+                       if (error != 0)
+                               return (error);
+               }
 #endif
                count = fp->f_count;
        retry:

-- 
You are receiving this mail because:
You are the assignee for the bug.