diff options
Diffstat (limited to 'sys')
| -rw-r--r-- | sys/kern/kern_jail.c | 13 | ||||
| -rw-r--r-- | sys/security/audit/audit_syscalls.c | 12 | ||||
| -rw-r--r-- | sys/sys/jail.h | 3 |
3 files changed, 14 insertions, 14 deletions
diff --git a/sys/kern/kern_jail.c b/sys/kern/kern_jail.c index 3697d95fe0e5..a75ba89d2a7e 100644 --- a/sys/kern/kern_jail.c +++ b/sys/kern/kern_jail.c @@ -243,9 +243,6 @@ static struct bool_flags pr_flag_allow[NBBY * NBPW] = { {"allow.unprivileged_parent_tampering", "allow.nounprivileged_parent_tampering", PR_ALLOW_UNPRIV_PARENT_TAMPER}, -#ifdef AUDIT - {"allow.setaudit", "allow.nosetaudit", PR_ALLOW_SETAUDIT}, -#endif }; static unsigned pr_allow_all = PR_ALLOW_ALL_STATIC; const size_t pr_flag_allow_size = sizeof(pr_flag_allow); @@ -4292,6 +4289,7 @@ prison_priv_check(struct ucred *cred, int priv) */ case PRIV_KTRACE: +#if 0 /* * Allow jailed processes to configure audit identity and * submit audit records (login, etc). In the future we may @@ -4300,11 +4298,6 @@ prison_priv_check(struct ucred *cred, int priv) */ case PRIV_AUDIT_GETAUDIT: case PRIV_AUDIT_SETAUDIT: - if (cred->cr_prison->pr_allow & PR_ALLOW_SETAUDIT) - return (0); - else - return (EPERM); -#if 0 case PRIV_AUDIT_SUBMIT: #endif @@ -5041,10 +5034,6 @@ SYSCTL_JAIL_PARAM(_allow, settime, CTLTYPE_INT | CTLFLAG_RW, "B", "Jail may set system time"); SYSCTL_JAIL_PARAM(_allow, routing, CTLTYPE_INT | CTLFLAG_RW, "B", "Jail may modify routing table"); -#ifdef AUDIT -SYSCTL_JAIL_PARAM(_allow, setaudit, CTLTYPE_INT | CTLFLAG_RW, - "B", "Jail may set and get audit session state"); -#endif SYSCTL_JAIL_PARAM_SUBNODE(allow, mount, "Jail mount/unmount permission flags"); SYSCTL_JAIL_PARAM(_allow_mount, , CTLTYPE_INT | CTLFLAG_RW, diff --git a/sys/security/audit/audit_syscalls.c b/sys/security/audit/audit_syscalls.c index 262f2c1ae1e3..40b2fb3d1c9f 100644 --- a/sys/security/audit/audit_syscalls.c +++ b/sys/security/audit/audit_syscalls.c @@ -592,6 +592,8 @@ sys_getauid(struct thread *td, struct getauid_args *uap) { int error; + if (jailed(td->td_ucred)) + return (ENOSYS); error = priv_check(td, PRIV_AUDIT_GETAUDIT); if (error) return (error); @@ -607,6 +609,8 @@ sys_setauid(struct thread *td, struct setauid_args *uap) au_id_t id; int error; + if (jailed(td->td_ucred)) + return (ENOSYS); error = copyin(uap->auid, &id, sizeof(id)); if (error) return (error); @@ -646,6 +650,8 @@ sys_getaudit(struct thread *td, struct getaudit_args *uap) int error; cred = td->td_ucred; + if (jailed(cred)) + return (ENOSYS); error = priv_check(td, PRIV_AUDIT_GETAUDIT); if (error) return (error); @@ -668,6 +674,8 @@ sys_setaudit(struct thread *td, struct setaudit_args *uap) struct auditinfo ai; int error; + if (jailed(td->td_ucred)) + return (ENOSYS); error = copyin(uap->auditinfo, &ai, sizeof(ai)); if (error) return (error); @@ -707,6 +715,8 @@ sys_getaudit_addr(struct thread *td, struct getaudit_addr_args *uap) { int error; + if (jailed(td->td_ucred)) + return (ENOSYS); if (uap->length < sizeof(*uap->auditinfo_addr)) return (EOVERFLOW); error = priv_check(td, PRIV_AUDIT_GETAUDIT); @@ -724,6 +734,8 @@ sys_setaudit_addr(struct thread *td, struct setaudit_addr_args *uap) struct auditinfo_addr aia; int error; + if (jailed(td->td_ucred)) + return (ENOSYS); error = copyin(uap->auditinfo_addr, &aia, sizeof(aia)); if (error) return (error); diff --git a/sys/sys/jail.h b/sys/sys/jail.h index e6a13e6719dd..e12e8c3178c9 100644 --- a/sys/sys/jail.h +++ b/sys/sys/jail.h @@ -271,7 +271,6 @@ struct prison_racct { #define PR_ALLOW_SETTIME 0x00100000 #define PR_ALLOW_ROUTING 0x00200000 #define PR_ALLOW_UNPRIV_PARENT_TAMPER 0x00400000 -#define PR_ALLOW_SETAUDIT 0x00800000 /* * PR_ALLOW_PRISON0 are the allow flags that we apply by default to prison0, @@ -279,7 +278,7 @@ struct prison_racct { * build time. PR_ALLOW_ALL_STATIC should contain any bit above that we expect * to be used on the system, while PR_ALLOW_PRISON0 will be some subset of that. */ -#define PR_ALLOW_ALL_STATIC 0x00ff87ff +#define PR_ALLOW_ALL_STATIC 0x007f87ff #define PR_ALLOW_PRISON0 \ (PR_ALLOW_ALL_STATIC & ~(PR_ALLOW_UNPRIV_PARENT_TAMPER)) |