imrcpan/freebsd
1
0 Fork 0
mirror of https://github.com/freebsd/freebsd-src.git synced 2026-10-28 11:25:21 +01:00
Code Issues Packages Projects Releases Wiki Activity

cap_net: correct capability name from addr2name to name2addr

Browse Source 
Previously, while checking name2addr capabilities, we mistakenly used
the addr2name set. This error could cause a process to inadvertently
reset its limitations.

Reported by:	Shawn Webb <[email protected]>

(cherry picked from commit afd74c4000)
(cherry picked from commit 765757c630)

Approved by:	so
Approved by:	re (implicit)
Security:	FreeBSD-SA-23:16.cap_net
Sponsored by:	The FreeBSD Foundation
This commit is contained in:
Mariusz Zaborski authored and Ed Maste committed 2023-11-07 19:45:34 -05:00
1 parent 1f9c4610dd
commit 5f4fc91cc8
2 files changed
+13 -1
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

lib/libcasper/services/cap_net/cap_net.c
+1 -1
View File
@@ -1232,7 +1232,7 @@ verify_name2addr_newlimits(const nvlist_t *oldlimits,
oldfunclimits = NULL;
if (oldlimits != NULL) {
oldfunclimits = dnvlist_get_nvlist(oldlimits,
LIMIT_NV_ADDR2NAME, NULL);
LIMIT_NV_NAME2ADDR, NULL);
}
cookie = NULL;
lib/libcasper/services/cap_net/tests/net_test.c
+12
View File
@@ -783,6 +783,18 @@ ATF_TC_BODY(capnet__limits_name2addr_hosts, tc)
limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR);
ATF_REQUIRE(cap_net_limit(limit) != 0);
/* Try to extend the limit. */
limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR);
ATF_REQUIRE(limit != NULL);
cap_net_limit_name2addr(limit, TEST_DOMAIN_1, NULL);
ATF_REQUIRE(cap_net_limit(limit) != 0);
limit = cap_net_limit_init(capnet, CAPNET_NAME2ADDR);
ATF_REQUIRE(limit != NULL);
cap_net_limit_name2addr(limit, TEST_DOMAIN_0, NULL);
cap_net_limit_name2addr(limit, TEST_DOMAIN_1, NULL);
ATF_REQUIRE(cap_net_limit(limit) != 0);
cap_close(capnet);
}