summaryrefslogtreecommitdiff
path: root/sys
diff options
context:
space:
mode:
authorelad <elad@NetBSD.org>2006-12-19 10:07:00 +0000
committerelad <elad@NetBSD.org>2006-12-19 10:07:00 +0000
commit9033a922ea53fffa2aa2f38ebd474466e3d705f2 (patch)
treeba3715154fc2ba35a39c41a312894960760e3c39 /sys
parentf1a69ab3eae0e399491598237587ae2be7980078 (diff)
Don't allow anyone but the superuser to do 'ctl' on procfs nodes.
Diffstat (limited to 'sys')
-rw-r--r--sys/secmodel/bsd44/secmodel_bsd44_suser.c8
1 files changed, 6 insertions, 2 deletions
diff --git a/sys/secmodel/bsd44/secmodel_bsd44_suser.c b/sys/secmodel/bsd44/secmodel_bsd44_suser.c
index e815dec8642..8914d8ae983 100644
--- a/sys/secmodel/bsd44/secmodel_bsd44_suser.c
+++ b/sys/secmodel/bsd44/secmodel_bsd44_suser.c
@@ -1,4 +1,4 @@
-/* $NetBSD: secmodel_bsd44_suser.c,v 1.18 2006/12/14 11:45:08 elad Exp $ */
+/* $NetBSD: secmodel_bsd44_suser.c,v 1.19 2006/12/19 10:07:00 elad Exp $ */
/*-
* Copyright (c) 2006 Elad Efrat <elad@NetBSD.org>
* All rights reserved.
@@ -41,7 +41,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: secmodel_bsd44_suser.c,v 1.18 2006/12/14 11:45:08 elad Exp $");
+__KERNEL_RCSID(0, "$NetBSD: secmodel_bsd44_suser.c,v 1.19 2006/12/19 10:07:00 elad Exp $");
#include <sys/types.h>
#include <sys/param.h>
@@ -271,6 +271,10 @@ secmodel_bsd44_suser_process_cb(kauth_cred_t cred, kauth_action_t action,
break;
case KAUTH_PROCESS_CANPROCFS:
+ if (((u_long)arg1 == KAUTH_REQ_PROCESS_CANPROCFS_CTL) &&
+ !isroot)
+ break;
+ /*FALLTHROUGH*/
case KAUTH_PROCESS_CANPTRACE:
case KAUTH_PROCESS_CANSYSTRACE:
if (isroot) {