diff options
| author | Mariusz Zaborski <oshogbo@FreeBSD.org> | 2023-09-28 13:24:39 +0000 |
|---|---|---|
| committer | Gordon Tetlow <gordon@FreeBSD.org> | 2023-10-03 21:24:41 +0000 |
| commit | 2d23f6c33431b19d8f91ad4832db01aa25062d43 (patch) | |
| tree | eece0f6ced3a8987110a998803f360e952163e95 | |
| parent | 7d08a7e6908b3ffb72061b7517ed29814d62355b (diff) | |
copy_file_range: require CAP_SEEK capability
When using copy_file_range(2) with an offset parameter,
the CAP_SEEK capability should be required.
This requirement is similar to the behavior observed with
pread(2)/pwrite(2).
Reported by: theraven
Reviewed by: emaste, theraven, kib, markj
Approved by: so
Security: FreeBSD-SA-23:13.capsicum
Security: CVE-2023-5369
Differential Revision: https://reviews.freebsd.org/D41967
(cherry picked from commit 15a51d3abaef27ddea66320cac7caa549738a1a6)
(cherry picked from commit 3f0ce63828dc3d4030b32ad0effb4e588af49c03)
| -rw-r--r-- | sys/kern/vfs_syscalls.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/sys/kern/vfs_syscalls.c b/sys/kern/vfs_syscalls.c index 3b3947b2ccb7..449c5ace6094 100644 --- a/sys/kern/vfs_syscalls.c +++ b/sys/kern/vfs_syscalls.c @@ -4896,7 +4896,8 @@ kern_copy_file_range(struct thread *td, int infd, off_t *inoffp, int outfd, len = SSIZE_MAX; /* Get the file structures for the file descriptors. */ - error = fget_read(td, infd, &cap_read_rights, &infp); + error = fget_read(td, infd, + inoffp != NULL ? &cap_pread_rights : &cap_read_rights, &infp); if (error != 0) goto out; if (infp->f_ops == &badfileops) { @@ -4907,7 +4908,8 @@ kern_copy_file_range(struct thread *td, int infd, off_t *inoffp, int outfd, error = EINVAL; goto out; } - error = fget_write(td, outfd, &cap_write_rights, &outfp); + error = fget_write(td, outfd, + outoffp != NULL ? &cap_pwrite_rights : &cap_write_rights, &outfp); if (error != 0) goto out; if (outfp->f_ops == &badfileops) { |