diff options
| author | elad <elad@NetBSD.org> | 2008-02-17 19:22:35 +0000 |
|---|---|---|
| committer | elad <elad@NetBSD.org> | 2008-02-17 19:22:35 +0000 |
| commit | 0bb7f5ccb36858264470c234535d85e0b67af3ac (patch) | |
| tree | 8e18babeff1c2111ca131fb5cd9256c96ef9dbe9 /sys/secmodel | |
| parent | 55ec6966620056a45d30874800647f5a1663120a (diff) | |
PR/37986: YAMAMOTO Takashi: any user can hog the all cpu with
_sched_setparam.
Pass proper context to kauth(9) for a decision to made based on the
scheduling policy and priority.
Diffstat (limited to 'sys/secmodel')
| -rw-r--r-- | sys/secmodel/bsd44/secmodel_bsd44_suser.c | 33 |
1 files changed, 22 insertions, 11 deletions
diff --git a/sys/secmodel/bsd44/secmodel_bsd44_suser.c b/sys/secmodel/bsd44/secmodel_bsd44_suser.c index 1d29ab5317c..1306fbf682f 100644 --- a/sys/secmodel/bsd44/secmodel_bsd44_suser.c +++ b/sys/secmodel/bsd44/secmodel_bsd44_suser.c @@ -1,4 +1,4 @@ -/* $NetBSD: secmodel_bsd44_suser.c,v 1.52 2008/02/16 16:39:35 elad Exp $ */ +/* $NetBSD: secmodel_bsd44_suser.c,v 1.53 2008/02/17 19:22:36 elad Exp $ */ /*- * Copyright (c) 2006 Elad Efrat <elad@NetBSD.org> * All rights reserved. @@ -38,7 +38,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: secmodel_bsd44_suser.c,v 1.52 2008/02/16 16:39:35 elad Exp $"); +__KERNEL_RCSID(0, "$NetBSD: secmodel_bsd44_suser.c,v 1.53 2008/02/17 19:22:36 elad Exp $"); #include <sys/types.h> #include <sys/param.h> @@ -692,17 +692,28 @@ secmodel_bsd44_suser_process_cb(kauth_cred_t cred, kauth_action_t action, case KAUTH_PROCESS_SCHEDULER_GET: case KAUTH_PROCESS_SCHEDULER_SET: case KAUTH_PROCESS_SCHEDULER_GETPARAM: + if (isroot || kauth_cred_uidmatch(cred, p->p_cred)) + result = KAUTH_RESULT_ALLOW; + + break; + case KAUTH_PROCESS_SCHEDULER_SETPARAM: - if (isroot || - (kauth_cred_getuid(cred) == - kauth_cred_getuid(p->p_cred) || - kauth_cred_geteuid(cred) == - kauth_cred_getuid(p->p_cred) || - kauth_cred_getuid(cred) == - kauth_cred_geteuid(p->p_cred) || - kauth_cred_geteuid(cred) == - kauth_cred_geteuid(p->p_cred))) + if (isroot) result = KAUTH_RESULT_ALLOW; + else if (kauth_cred_uidmatch(cred, p->p_cred)) { + struct lwp *l; + int policy; + pri_t priority; + + l = arg1; + policy = (int)(unsigned long)arg2; + priority = (pri_t)(unsigned long)arg3; + + if ((policy == l->l_class || + (policy != SCHED_FIFO && policy != SCHED_RR)) && + priority <= l->l_priority) + result = KAUTH_RESULT_ALLOW; + } break; |
