RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-05-31 15:28:11 +00:00
Code Issues Activity Actions

Kernel: Fix TOCTOU in sys$unveil()

Browse source 
Make sure we reject the unveil attempt with EPERM if the veil was locked
by another thread while we were parsing argument (and not holding the
veil state spinlock.)

Thanks Brian for spotting this! :^)

Amendment to #14907.
This commit is contained in:
Andreas Kling 2022-08-18 01:03:00 +02:00
parent ae3fa20252
commit 04c362b4dd
1 changed files with 5 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

5
Kernel/Syscalls/unveil.cpp
View file

@ -95,6 +95,11 @@ ErrorOr<FlatPtr> Process::sys$unveil(Userspace<Syscall::SC_unveil_params const*>
auto path_parts = KLexicalPath::parts(new_unveiled_path->view());
auto it = path_parts.begin();
return m_unveil_data.with([&](auto& unveil_data) -> ErrorOr<FlatPtr> {
// NOTE: We have to check again, since the veil may have been locked by another thread
// while we were parsing the arguments.
if (unveil_data.state == VeilState::Locked)
return EPERM;
auto& matching_node = unveil_data.paths.traverse_until_last_accessible_node(it, path_parts.end());
if (it.is_end()) {
// If the path has already been explicitly unveiled, do not allow elevating its permissions.