I forgot execve would go through the namei codepath, so a program marked

"stdio rpath" this would fail to execve.  pre-indicate exec actions to the
namei checker to allow them through.
ok semarie

diff --git a/sys/kern/kern_exec.c b/sys/kern/kern_exec.c
index d47f252..8b3f0e5 100644 (file)
--- a/sys/kern/kern_exec.c
+++ b/sys/kern/kern_exec.c
@@ -1,4 +1,4 @@
-/*     $OpenBSD: kern_exec.c,v 1.168 2015/10/09 01:10:27 deraadt Exp $ */
+/*     $OpenBSD: kern_exec.c,v 1.169 2015/10/10 14:46:15 deraadt Exp $ */
 /*     $NetBSD: kern_exec.c,v 1.75 1996/02/09 18:59:28 christos Exp $  */
 
 /*-
@@ -280,6 +280,7 @@ sys_execve(struct proc *p, void *v, register_t *retval)
         * Mark this process as "leave me alone, I'm execing".
         */
        atomic_setbits_int(&pr->ps_flags, PS_INEXEC);
+       p->p_pledgenote = TMN_XPATH;
 
 #if NSYSTRACE > 0
        if (ISSET(p->p_flag, P_SYSTRACE)) {

diff --git a/sys/kern/kern_pledge.c b/sys/kern/kern_pledge.c
index ef2314a..9402d1e 100644 (file)
--- a/sys/kern/kern_pledge.c
+++ b/sys/kern/kern_pledge.c
@@ -1,4 +1,4 @@
-/*     $OpenBSD: kern_pledge.c,v 1.6 2015/10/09 23:55:03 deraadt Exp $ */
+/*     $OpenBSD: kern_pledge.c,v 1.7 2015/10/10 14:46:15 deraadt Exp $ */
 
 /*
  * Copyright (c) 2015 Nicholas Marriott <nicm@openbsd.org>
@@ -513,6 +513,11 @@ pledge_namei(struct proc *p, char *origpath)
            ((p->p_p->ps_pledge & PLEDGE_CPATH) == 0))
                return (pledge_fail(p, EPERM, PLEDGE_CPATH));
 
+       /* Doing a permitted execve() */
+       if ((p->p_pledgenote & TMN_XPATH) &&
+           (p->p_p->ps_pledge & PLEDGE_EXEC))
+               return (0);
+
        if ((p->p_pledgenote & TMN_WPATH) &&
            (p->p_p->ps_pledge & PLEDGE_WPATH) == 0)
                return (pledge_fail(p, EPERM, PLEDGE_WPATH));

diff --git a/sys/sys/proc.h b/sys/sys/proc.h
index 064fd1d..831c43f 100644 (file)
--- a/sys/sys/proc.h
+++ b/sys/sys/proc.h
@@ -1,4 +1,4 @@
-/*     $OpenBSD: proc.h,v 1.206 2015/10/09 01:10:27 deraadt Exp $      */
+/*     $OpenBSD: proc.h,v 1.207 2015/10/10 14:46:15 deraadt Exp $      */
 /*     $NetBSD: proc.h,v 1.44 1996/04/22 01:23:21 christos Exp $       */
 
 /*-
@@ -331,8 +331,9 @@ struct proc {
 #define TMN_RPATH      0x00000001
 #define TMN_WPATH      0x00000002
 #define TMN_CPATH      0x00000004
-#define TMN_FATTR      0x00000008
-#define TMN_COREDUMP   0x00000010
+#define TMN_XPATH      0x00000008
+#define TMN_FATTR      0x00000010
+#define TMN_COREDUMP   0x00000020
        int     p_pledgeafter;
 #define TMA_YPLOCK     0x00000001
 #define TMA_DNSRESOLV  0x00000002