summaryrefslogtreecommitdiff
path: root/sys/dev
diff options
context:
space:
mode:
authorelad <elad@NetBSD.org>2005-06-16 15:41:36 +0000
committerelad <elad@NetBSD.org>2005-06-16 15:41:36 +0000
commit27cb371b940ca4c536d70bbf84fa9a077d463db9 (patch)
treecb84dadc44b13c0aa1c0d92e3b59294d042eab57 /sys/dev
parent68988657cdd132c7edacde5f74f167c6b97f2850 (diff)
Don't allow unprivileged users to open the veriexec device.
While I'm here, explicit 'int' for 'veriexec_device_usage'.
Diffstat (limited to 'sys/dev')
-rw-r--r--sys/dev/verified_exec.c11
1 files changed, 7 insertions, 4 deletions
diff --git a/sys/dev/verified_exec.c b/sys/dev/verified_exec.c
index 13986842150..e89265df6da 100644
--- a/sys/dev/verified_exec.c
+++ b/sys/dev/verified_exec.c
@@ -1,4 +1,4 @@
-/* $NetBSD: verified_exec.c,v 1.12 2005/06/06 02:48:20 christos Exp $ */
+/* $NetBSD: verified_exec.c,v 1.13 2005/06/16 15:41:36 elad Exp $ */
/*-
* Copyright 2005 Elad Efrat <elad@bsd.org.il>
@@ -31,9 +31,9 @@
#include <sys/cdefs.h>
#if defined(__NetBSD__)
-__KERNEL_RCSID(0, "$NetBSD: verified_exec.c,v 1.12 2005/06/06 02:48:20 christos Exp $");
+__KERNEL_RCSID(0, "$NetBSD: verified_exec.c,v 1.13 2005/06/16 15:41:36 elad Exp $");
#else
-__RCSID("$Id: verified_exec.c,v 1.12 2005/06/06 02:48:20 christos Exp $\n$NetBSD: verified_exec.c,v 1.12 2005/06/06 02:48:20 christos Exp $");
+__RCSID("$Id: verified_exec.c,v 1.13 2005/06/16 15:41:36 elad Exp $\n$NetBSD: verified_exec.c,v 1.13 2005/06/16 15:41:36 elad Exp $");
#endif
#include <sys/param.h>
@@ -64,7 +64,7 @@ __RCSID("$Id: verified_exec.c,v 1.12 2005/06/06 02:48:20 christos Exp $\n$NetBSD
#include <sys/verified_exec.h>
/* count of number of times device is open (we really only allow one open) */
-static unsigned veriexec_dev_usage;
+static unsigned int veriexec_dev_usage;
struct veriexec_softc {
DEVPORT_DEVICE veriexec_dev;
@@ -127,6 +127,9 @@ veriexecopen(dev_t dev __unused, int flags __unused,
p->p_pid, dev);
#endif
+ if (suser(p->p_ucred, &p->p_acflag) != 0)
+ return (EPERM);
+
if (veriexec_dev_usage > 0) {
veriexec_dprintf(("Veriexec: load device already in use\n"));
return(EBUSY);