From: semarie <semarie@openbsd.org>
Date: Fri, 16 Oct 2015 14:04:11 +0000 (+0000)
Subject: delete pledge_bind_check() function and remove pledge_bind_check() call from sys_bind().
X-Git-Url: http://artulab.com/gitweb/?a=commitdiff_plain;h=eca9e229172cad541818effda99d1c382e9ce9a4;p=openbsd

delete pledge_bind_check() function and remove pledge_bind_check() call from sys_bind().

bind(2) still require PLEDGE_INET or PLEDGE_UNIX in order to be called, due to
SYS_bind entry in pledge_syscalls array. The diff restores also the ability for
PLEDGE_UNIX to call bind(2) (pledge_bind_check function missed that).

problem spotted by doug@
OK deraadt@
---

diff --git a/sys/kern/kern_pledge.c b/sys/kern/kern_pledge.c
index ee0c65ce503..b3e3f298615 100644
--- a/sys/kern/kern_pledge.c
+++ b/sys/kern/kern_pledge.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: kern_pledge.c,v 1.35 2015/10/16 14:00:37 deraadt Exp $	*/
+/*	$OpenBSD: kern_pledge.c,v 1.36 2015/10/16 14:04:11 semarie Exp $	*/
 
 /*
  * Copyright (c) 2015 Nicholas Marriott <nicm@openbsd.org>
@@ -1003,17 +1003,6 @@ pledge_socket_check(struct proc *p, int domain)
 	return (EPERM);
 }
 
-int
-pledge_bind_check(struct proc *p, const void *v)
-{
-
-	if ((p->p_p->ps_flags & PS_PLEDGE) == 0)
-		return (0);
-	if ((p->p_p->ps_pledge & PLEDGE_INET))
-		return (0);
-	return (EPERM);
-}
-
 int
 pledge_ioctl_check(struct proc *p, long com, void *v)
 {
diff --git a/sys/kern/uipc_syscalls.c b/sys/kern/uipc_syscalls.c
index 13780c4a5ac..be46da89863 100644
--- a/sys/kern/uipc_syscalls.c
+++ b/sys/kern/uipc_syscalls.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: uipc_syscalls.c,v 1.112 2015/10/09 01:10:27 deraadt Exp $	*/
+/*	$OpenBSD: uipc_syscalls.c,v 1.113 2015/10/16 14:04:11 semarie Exp $	*/
 /*	$NetBSD: uipc_syscalls.c,v 1.19 1996/02/09 19:00:48 christos Exp $	*/
 
 /*
@@ -124,9 +124,6 @@ sys_bind(struct proc *p, void *v, register_t *retval)
 	struct mbuf *nam;
 	int error;
 
-	if (pledge_bind_check(p, SCARG(uap, name)))
-		return (pledge_fail(p, EPERM, PLEDGE_UNIX));
-
 	if ((error = getsock(p, SCARG(uap, s), &fp)) != 0)
 		return (error);
 	error = sockargs(&nam, SCARG(uap, name), SCARG(uap, namelen),
diff --git a/sys/sys/pledge.h b/sys/sys/pledge.h
index cfa80ee5024..3d7fa02cf22 100644
--- a/sys/sys/pledge.h
+++ b/sys/sys/pledge.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: pledge.h,v 1.3 2015/10/16 13:37:44 millert Exp $	*/
+/*	$OpenBSD: pledge.h,v 1.4 2015/10/16 14:04:11 semarie Exp $	*/
 
 /*
  * Copyright (c) 2015 Nicholas Marriott <nicm@openbsd.org>
@@ -69,7 +69,6 @@ int	pledge_chown_check(struct proc *p, uid_t, gid_t);
 int	pledge_adjtime_check(struct proc *p, const void *v);
 int	pledge_recvfrom_check(struct proc *p, void *from);
 int	pledge_sendto_check(struct proc *p, const void *to);
-int	pledge_bind_check(struct proc *p, const void *v);
 int	pledge_connect_check(struct proc *p);
 int	pledge_socket_check(struct proc *p, int domain);
 int	pledge_setsockopt_check(struct proc *p, int level, int optname);