⬢ DragonFlyBSD Kernel Audit
DF-0510 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
diff --git a/sys/netgraph7/ksocket/ng_ksocket.c b/sys/netgraph7/ksocket/ng_ksocket.c
--- a/sys/netgraph7/ksocket/ng_ksocket.c
+++ b/sys/netgraph7/ksocket/ng_ksocket.c
@@ -543,11 +543,16 @@
 static int
 ng_ksocket_newhook(node_p node, hook_p hook, const char *name0)
 {
-	struct thread *td = curthread->td_proc ? curthread : &thread0;	/* XXX broken */
+	struct thread *td = curthread->td_proc ? curthread : NULL;	/* DF-0510: was &thread0 (root creds) */
 	const priv_p priv = NG_NODE_PRIVATE(node);
 	char *s1, *s2, name[NG_HOOKSIZ];
 	int family, type, protocol, error;
 
+	/* DF-0510: refuse to create a socket without a real process
+	 * context; previously this fell back to &thread0=root creds. */
+	if (td == NULL)
+		return (EPERM);
+
 	/* Check if we're already connected */
 	if (priv->hook != NULL)
 		return (EISCONN);
@@ -658,13 +663,21 @@
 static int
 ng_ksocket_rcvmsg(node_p node, item_p item, hook_p lasthook)
 {
-	struct thread *td = curthread->td_proc ? curthread : &thread0;	/* XXX broken */
+	struct thread *td = curthread->td_proc ? curthread : NULL;	/* DF-0510: was &thread0 (root creds) */
 	const priv_p priv = NG_NODE_PRIVATE(node);
 	struct socket *const so = priv->so;
 	struct ng_mesg *resp = NULL;
 	int error = 0;
 	struct ng_mesg *msg;
 
+	/* DF-0510: refuse socket-control messages without a real process
+	 * context; previously fell back to &thread0=root creds (priv bypass). */
+	if (td == NULL) {
+		NGI_GET_MSG(item, msg);
+		NG_FREE_MSG(msg);
+		return (EPERM);
+	}
+
 	NGI_GET_MSG(item, msg);
 	switch (msg->header.typecookie) {
 	case NGM_KSOCKET_COOKIE:
@@ -883,7 +896,7 @@
 static int
 ng_ksocket_rcvdata(hook_p hook, item_p item)
 {
-	struct thread *td = curthread->td_proc ? curthread : &thread0;	/* XXX broken */
+	struct thread *td = curthread->td_proc ? curthread : NULL;	/* DF-0510: was &thread0 (root creds) */
 	const node_p node = NG_HOOK_NODE(hook);
 	const priv_p priv = NG_NODE_PRIVATE(node);
 	struct socket *const so = priv->so;
@@ -892,6 +905,15 @@
 	struct mbuf *m;
 	struct sa_tag *stag;
 
+	/* DF-0510: refuse to send without a real process context; previously
+	 * fell back to &thread0=root creds (priv bypass). */
+	if (td == NULL) {
+		NGI_GET_M(item, m);
+		NG_FREE_M(m);
+		NG_FREE_ITEM(item);
+		return (EPERM);
+	}
+
 	/* Extract data */
 	NGI_GET_M(item, m);
 	NG_FREE_ITEM(item);