Remove the code to store intermediary vnodes in the unveil list.

These traversed vnodes are a leftover from early times where realpath(3)
was still all done in userland.
OK semarie@

diff --git a/sys/kern/kern_unveil.c b/sys/kern/kern_unveil.c
index b541c9c..b6d8960 100644 (file)
--- a/sys/kern/kern_unveil.c
+++ b/sys/kern/kern_unveil.c
@@ -1,4 +1,4 @@
-/*     $OpenBSD: kern_unveil.c,v 1.45 2021/06/29 07:55:29 claudio Exp $        */
+/*     $OpenBSD: kern_unveil.c,v 1.46 2021/07/08 13:33:05 claudio Exp $        */
 
 /*
  * Copyright (c) 2017-2019 Bob Beck <beck@openbsd.org>
@@ -80,35 +80,6 @@ unvname_new(const char *name, size_t size, u_char flags)
        return ret;
 }
 
-void
-unveil_free_traversed_vnodes(struct nameidata *ndp)
-{
-       if (ndp->ni_tvpsize) {
-               size_t i;
-
-               for (i = 0; i < ndp->ni_tvpend; i++)
-                       vrele(ndp->ni_tvp[i]); /* ref for being in list */
-               free(ndp->ni_tvp, M_PROC, ndp->ni_tvpsize *
-                   sizeof(struct vnode *));
-               ndp->ni_tvpsize = 0;
-               ndp->ni_tvpend = 0;
-       }
-}
-
-void
-unveil_save_traversed_vnode(struct nameidata *ndp, struct vnode *vp)
-{
-       if (ndp->ni_tvpsize == 0) {
-               ndp->ni_tvp = mallocarray(MAXPATHLEN, sizeof(struct vnode *),
-                   M_PROC, M_WAITOK);
-               ndp->ni_tvpsize = MAXPATHLEN;
-       }
-       /* This should be limited by MAXPATHLEN on a single lookup */
-       KASSERT(ndp->ni_tvpsize > ndp->ni_tvpend);
-       vref(vp); /* ref for being in the list */
-       ndp->ni_tvp[ndp->ni_tvpend++] = vp;
-}
-
 void
 unvname_delete(struct unvname *name)
 {
@@ -455,23 +426,6 @@ unveil_add_vnode(struct proc *p, struct vnode *vp)
        return (uv);
 }
 
-void
-unveil_add_traversed_vnodes(struct proc *p, struct nameidata *ndp)
-{
-       if (ndp->ni_tvpsize) {
-               size_t i;
-
-               for (i = 0; i < ndp->ni_tvpend; i++) {
-                       struct vnode *vp = ndp->ni_tvp[i];
-                       if (unveil_lookup(vp, p->p_p, NULL) == NULL) {
-                               vref(vp);
-                               vp->v_uvcount++;
-                               unveil_add_vnode(p, vp);
-                       }
-               }
-       }
-}
-
 int
 unveil_add(struct proc *p, struct nameidata *ndp, const char *permissions)
 {
@@ -492,7 +446,7 @@ unveil_add(struct proc *p, struct nameidata *ndp, const char *permissions)
                    sizeof(struct unveil), M_PROC, M_WAITOK|M_ZERO);
        }
 
-       if ((pr->ps_uvvcount + ndp->ni_tvpend) >= UNVEIL_MAX_VNODES ||
+       if (pr->ps_uvvcount >= UNVEIL_MAX_VNODES ||
            pr->ps_uvncount >= UNVEIL_MAX_NAMES) {
                ret = E2BIG;
                goto done;
@@ -595,9 +549,6 @@ unveil_add(struct proc *p, struct nameidata *ndp, const char *permissions)
 #endif
 
  done:
-       if (ret == 0)
-               unveil_add_traversed_vnodes(p, ndp);
-
        pr->ps_uvpcwd = unveil_lookup(p->p_fd->fd_cdir, pr, NULL);
        if (pr->ps_uvpcwd == NULL) {
                ssize_t i;
@@ -754,10 +705,8 @@ unveil_check_component(struct proc *p, struct nameidata *ni, struct vnode *dp)
        struct process *pr = p->p_p;
        struct unveil *uv = NULL;
 
-       if (ni->ni_pledge == PLEDGE_UNVEIL) {
-               unveil_save_traversed_vnode(ni, dp);
+       if (ni->ni_pledge == PLEDGE_UNVEIL || pr->ps_uvpaths == NULL)
                return;
-       }
        if (ni->ni_cnd.cn_flags & BYPASSUNVEIL)
                return;
 

diff --git a/sys/kern/vfs_syscalls.c b/sys/kern/vfs_syscalls.c
index d4f84e4..e2681bb 100644 (file)
--- a/sys/kern/vfs_syscalls.c
+++ b/sys/kern/vfs_syscalls.c
@@ -1,4 +1,4 @@
-/*     $OpenBSD: vfs_syscalls.c,v 1.350 2021/07/03 17:51:59 semarie Exp $      */
+/*     $OpenBSD: vfs_syscalls.c,v 1.351 2021/07/08 13:33:05 claudio Exp $      */
 /*     $NetBSD: vfs_syscalls.c,v 1.71 1996/04/23 10:29:02 mycroft Exp $        */
 
 /*
@@ -1007,7 +1007,7 @@ sys_unveil(struct proc *p, void *v, register_t *retval)
 
        nd.ni_pledge = PLEDGE_UNVEIL;
        if ((error = namei(&nd)) != 0)
-               goto ndfree;
+               goto end;
 
        /*
         * XXX Any access to the file or directory will allow us to
@@ -1040,8 +1040,6 @@ sys_unveil(struct proc *p, void *v, register_t *retval)
                vrele(nd.ni_dvp);
 
        pool_put(&namei_pool, nd.ni_cnd.cn_pnbuf);
-ndfree:
-       unveil_free_traversed_vnodes(&nd);
 end:
        pool_put(&namei_pool, pathname);
 

diff --git a/sys/sys/namei.h b/sys/sys/namei.h
index 975dfa9..f392dbf 100644 (file)
--- a/sys/sys/namei.h
+++ b/sys/sys/namei.h
@@ -1,4 +1,4 @@
-/*     $OpenBSD: namei.h,v 1.45 2020/03/19 13:55:20 anton Exp $        */
+/*     $OpenBSD: namei.h,v 1.46 2021/07/08 13:33:05 claudio Exp $      */
 /*     $NetBSD: namei.h,v 1.11 1996/02/09 18:25:20 christos Exp $      */
 
 /*
@@ -75,9 +75,6 @@ struct nameidata {
        char    *ni_next;               /* next location in pathname */
        u_long  ni_loopcnt;             /* count of symlinks encountered */
        struct unveil *ni_unveil_match; /* last matching unveil component */
-       struct vnode **ni_tvp;          /* traversed vnodes */
-       size_t ni_tvpend;               /* end of traversed vnode list */
-       size_t ni_tvpsize;              /* size of traversed vnode list */
        int ni_unveil_eacces;           /* indicates unveil flag mismatch */
 
        /*
@@ -208,7 +205,6 @@ void cache_purgevfs(struct mount *);
 
 int unveil_add(struct proc *, struct nameidata *, const char *);
 void unveil_removevnode(struct vnode *);
-void unveil_free_traversed_vnodes(struct nameidata *);
 ssize_t unveil_find_cover(struct vnode *, struct proc *);
 struct unveil *unveil_lookup(struct vnode *, struct process *, ssize_t *);
 void unveil_start_relative(struct proc *, struct nameidata *, struct vnode *);