From 59146ba0e071fb39ac5158b54b912303a68b97ea Mon Sep 17 00:00:00 2001
From: deraadt <deraadt@openbsd.org>
Date: Sat, 10 Oct 2015 14:46:15 +0000
Subject: [PATCH] I forgot execve would go through the namei codepath, so a
 program marked "stdio rpath" this would fail to execve.  pre-indicate exec
 actions to the namei checker to allow them through. ok semarie

---
 sys/kern/kern_exec.c   | 3 ++-
 sys/kern/kern_pledge.c | 7 ++++++-
 sys/sys/proc.h         | 7 ++++---
 3 files changed, 12 insertions(+), 5 deletions(-)

diff --git a/sys/kern/kern_exec.c b/sys/kern/kern_exec.c
index d47f2520e4e..8b3f0e5e50d 100644
--- a/sys/kern/kern_exec.c
+++ b/sys/kern/kern_exec.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: kern_exec.c,v 1.168 2015/10/09 01:10:27 deraadt Exp $	*/
+/*	$OpenBSD: kern_exec.c,v 1.169 2015/10/10 14:46:15 deraadt Exp $	*/
 /*	$NetBSD: kern_exec.c,v 1.75 1996/02/09 18:59:28 christos Exp $	*/
 
 /*-
@@ -280,6 +280,7 @@ sys_execve(struct proc *p, void *v, register_t *retval)
 	 * Mark this process as "leave me alone, I'm execing".
 	 */
 	atomic_setbits_int(&pr->ps_flags, PS_INEXEC);
+	p->p_pledgenote = TMN_XPATH;
 
 #if NSYSTRACE > 0
 	if (ISSET(p->p_flag, P_SYSTRACE)) {
diff --git a/sys/kern/kern_pledge.c b/sys/kern/kern_pledge.c
index ef2314ace41..9402d1e98eb 100644
--- a/sys/kern/kern_pledge.c
+++ b/sys/kern/kern_pledge.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: kern_pledge.c,v 1.6 2015/10/09 23:55:03 deraadt Exp $	*/
+/*	$OpenBSD: kern_pledge.c,v 1.7 2015/10/10 14:46:15 deraadt Exp $	*/
 
 /*
  * Copyright (c) 2015 Nicholas Marriott <nicm@openbsd.org>
@@ -513,6 +513,11 @@ pledge_namei(struct proc *p, char *origpath)
 	    ((p->p_p->ps_pledge & PLEDGE_CPATH) == 0))
 		return (pledge_fail(p, EPERM, PLEDGE_CPATH));
 
+	/* Doing a permitted execve() */
+	if ((p->p_pledgenote & TMN_XPATH) &&
+	    (p->p_p->ps_pledge & PLEDGE_EXEC))
+		return (0);
+
 	if ((p->p_pledgenote & TMN_WPATH) &&
 	    (p->p_p->ps_pledge & PLEDGE_WPATH) == 0)
 		return (pledge_fail(p, EPERM, PLEDGE_WPATH));
diff --git a/sys/sys/proc.h b/sys/sys/proc.h
index 064fd1d93c2..831c43fff7f 100644
--- a/sys/sys/proc.h
+++ b/sys/sys/proc.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: proc.h,v 1.206 2015/10/09 01:10:27 deraadt Exp $	*/
+/*	$OpenBSD: proc.h,v 1.207 2015/10/10 14:46:15 deraadt Exp $	*/
 /*	$NetBSD: proc.h,v 1.44 1996/04/22 01:23:21 christos Exp $	*/
 
 /*-
@@ -331,8 +331,9 @@ struct proc {
 #define TMN_RPATH	0x00000001
 #define TMN_WPATH	0x00000002
 #define TMN_CPATH	0x00000004
-#define TMN_FATTR	0x00000008
-#define TMN_COREDUMP	0x00000010
+#define TMN_XPATH	0x00000008
+#define TMN_FATTR	0x00000010
+#define TMN_COREDUMP	0x00000020
 	int	p_pledgeafter;
 #define TMA_YPLOCK	0x00000001
 #define TMA_DNSRESOLV	0x00000002
-- 
2.20.1