jimzah/freebsd-src
1
0
Fork 0
mirror of https://github.com/freebsd/freebsd-src.git synced 2024-11-27 09:12:44 +00:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

cap_net: correct capability name from addr2name to name2addr

Browse Source 
Previously, while checking name2addr capabilities, we mistakenly used
the addr2name set. This error could cause a process to inadvertently
reset its limitations.

Reported by:	Shawn Webb <shawn.webb@hardenedbsd.org>

(cherry picked from commit afd74c4000)
(cherry picked from commit 765757c630)
This commit is contained in:
Mariusz Zaborski 2023-10-23 23:03:51 +02:00 committed by Ed Maste
parent ccdd8337f9
commit 114c6d9bef
2 changed files with 13 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
lib/libcasper/services/cap_net/cap_net.c
View File

@ -1232,7 +1232,7 @@ verify_name2addr_newlimits(const nvlist_t *oldlimits,
oldfunclimits = NULL;
if (oldlimits != NULL) {
oldfunclimits = dnvlist_get_nvlist(oldlimits,
LIMIT_NV_ADDR2NAME, NULL);
LIMIT_NV_NAME2ADDR, NULL);
}
cookie = NULL;

12
lib/libcasper/services/cap_net/tests/net_test.c
View File

@ -742,6 +742,18 @@ ATF_TC_BODY(capnet__limits_name2addr_hosts, tc)
limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR);
ATF_REQUIRE(cap_net_limit(limit) != 0);
/* Try to extend the limit. */
limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR);
ATF_REQUIRE(limit != NULL);
cap_net_limit_name2addr(limit, TEST_DOMAIN_1, NULL);
ATF_REQUIRE(cap_net_limit(limit) != 0);
limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR);
ATF_REQUIRE(limit != NULL);
cap_net_limit_name2addr(limit, TEST_DOMAIN_0, NULL);
cap_net_limit_name2addr(limit, TEST_DOMAIN_1, NULL);
ATF_REQUIRE(cap_net_limit(limit) != 0);
cap_close(capnet);
}