diff options
Diffstat (limited to 'sys/kern/uipc_syscalls.c')
| -rw-r--r-- | sys/kern/uipc_syscalls.c | 29 |
1 files changed, 20 insertions, 9 deletions
diff --git a/sys/kern/uipc_syscalls.c b/sys/kern/uipc_syscalls.c index 85b2214eaeb9..6c13740d8094 100644 --- a/sys/kern/uipc_syscalls.c +++ b/sys/kern/uipc_syscalls.c @@ -201,8 +201,12 @@ kern_bindat(struct thread *td, int dirfd, int fd, struct sockaddr *sa) int error; #ifdef CAPABILITY_MODE - if (IN_CAPABILITY_MODE(td) && (dirfd == AT_FDCWD)) - return (ECAPMODE); + if (dirfd == AT_FDCWD) { + if (CAP_TRACING(td)) + ktrcapfail(CAPFAIL_NAMEI, "AT_FDCWD"); + if (IN_CAPABILITY_MODE(td)) + return (ECAPMODE); + } #endif AUDIT_ARG_FD(fd); @@ -487,8 +491,12 @@ kern_connectat(struct thread *td, int dirfd, int fd, struct sockaddr *sa) int error; #ifdef CAPABILITY_MODE - if (IN_CAPABILITY_MODE(td) && (dirfd == AT_FDCWD)) - return (ECAPMODE); + if (dirfd == AT_FDCWD) { + if (CAP_TRACING(td)) + ktrcapfail(CAPFAIL_NAMEI, "AT_FDCWD"); + if (IN_CAPABILITY_MODE(td)) + return (ECAPMODE); + } #endif AUDIT_ARG_FD(fd); @@ -665,11 +673,6 @@ sendit(struct thread *td, int s, struct msghdr *mp, int flags) struct sockaddr *to; int error; -#ifdef CAPABILITY_MODE - if (IN_CAPABILITY_MODE(td) && (mp->msg_name != NULL)) - return (ECAPMODE); -#endif - if (mp->msg_name != NULL) { error = getsockaddr(&to, mp->msg_name, mp->msg_namelen); if (error != 0) { @@ -677,6 +680,14 @@ sendit(struct thread *td, int s, struct msghdr *mp, int flags) goto bad; } mp->msg_name = to; +#ifdef CAPABILITY_MODE + if (CAP_TRACING(td)) + ktrcapfail(CAPFAIL_SOCKADDR, mp->msg_name); + if (IN_CAPABILITY_MODE(td)) { + error = ECAPMODE; + goto bad; + } +#endif } else { to = NULL; } |