[src/netbsd-1-4]: src/sys/miscfs/procfs Pull up revision 1.32 (via patch, req...

[he <he%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/7ba68b3c6b8f
branches:  netbsd-1-4
changeset: 470246:7ba68b3c6b8f
user:      he <he%NetBSD.org@localhost>
date:      Tue Feb 01 22:55:58 2000 +0000

description:
Pull up revision 1.32 (via patch, requested by fvdl):
  Close procfs security hole.  Fixes SA#2000-001.

diffstat:

 sys/miscfs/procfs/procfs_vfsops.c |  19 +++++++++++++++++--
 1 files changed, 17 insertions(+), 2 deletions(-)

diffs (67 lines):

diff -r 6d951656f392 -r 7ba68b3c6b8f sys/miscfs/procfs/procfs_vfsops.c
--- a/sys/miscfs/procfs/procfs_vfsops.c Tue Feb 01 22:55:30 2000 +0000
+++ b/sys/miscfs/procfs/procfs_vfsops.c Tue Feb 01 22:55:58 2000 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: procfs_vfsops.c,v 1.31 1999/02/26 23:44:46 wrstuden Exp $      */
+/*     $NetBSD: procfs_vfsops.c,v 1.31.2.1 2000/02/01 22:55:58 he Exp $        */
 
 /*
  * Copyright (c) 1993 Jan-Simon Pendry
@@ -57,6 +57,7 @@
 #include <sys/mount.h>
 #include <sys/signalvar.h>
 #include <sys/vnode.h>
+#include <sys/malloc.h>
 #include <miscfs/procfs/procfs.h>
 #include <vm/vm.h>                     /* for PAGE_SIZE */
 
@@ -91,6 +92,7 @@
        struct proc *p;
 {
        size_t size;
+       struct procfsmount *pmnt;
 
        if (UIO_MX & (UIO_MX-1)) {
                log(LOG_ERR, "procfs: invalid directory entry size");
@@ -101,13 +103,20 @@
                return (EOPNOTSUPP);
 
        mp->mnt_flag |= MNT_LOCAL;
-       mp->mnt_data = 0;
+       pmnt = (struct procfsmount *) malloc(sizeof(struct procfsmount),
+           M_UFSMNT, M_WAITOK);   /* XXX need new malloc type */
+
+       mp->mnt_data = (qaddr_t)pmnt;
        vfs_getnewfsid(mp, MOUNT_PROCFS);
 
        (void) copyinstr(path, mp->mnt_stat.f_mntonname, MNAMELEN, &size);
        memset(mp->mnt_stat.f_mntonname + size, 0, MNAMELEN - size);
        memset(mp->mnt_stat.f_mntfromname, 0, MNAMELEN);
        memcpy(mp->mnt_stat.f_mntfromname, "procfs", sizeof("procfs"));
+
+       pmnt->pmnt_exechook = exechook_establish(procfs_revoke_vnodes, mp);
+       pmnt->pmnt_mp = mp;
+
        return (0);
 }
 
@@ -129,6 +138,11 @@
        if ((error = vflush(mp, 0, flags)) != 0)
                return (error);
 
+       exechook_disestablish(VFSTOPROC(mp)->pmnt_exechook);
+
+       free(mp->mnt_data, M_UFSMNT);
+       mp->mnt_data = 0;
+
        return (0);
 }
 
@@ -255,6 +269,7 @@
 void
 procfs_init()
 {
+       procfs_hashinit();
 }
 
 int