upstream/opnsense-src
1
0
Fork 0
mirror of https://github.com/opnsense/src.git synced 2026-06-09 08:43:19 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

netstat: strip the binary of sgid

Browse source 
Everything in the live path seems to use sysctls these days, with kvm
only being used for pulling information from core dumps.  Strip the
binary of /dev/{k,}mem access to reduce the surface area with access
to kmem.

Reviewed by:	glebius, markj
Differential Revision:	https://reviews.freebsd.org/D47210
This commit is contained in:
Kyle Evans 2025-04-20 13:18:40 -05:00
parent d8fd551438
commit 49f31b5e0c
2 changed files with 2 additions and 14 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
usr.bin/netstat/Makefile
View file

@ -50,8 +50,6 @@ CFLAGS+=-DSDP
CFLAGS+=-DPF
.endif
BINGRP= kmem
BINMODE=2555
LIBADD= kvm memstat xo util
.if ${MK_NETGRAPH_SUPPORT} != "no"

14
usr.bin/netstat/main.c
View file

@ -455,17 +455,10 @@ main(int argc, char *argv[])
}
#endif
/*
* Discard setgid privileges if not the running kernel so that bad
* guys can't print interesting stuff from kernel memory.
*/
live = (nlistf == NULL && memf == NULL);
if (!live) {
if (setgid(getgid()) != 0)
xo_err(EX_OSERR, "setgid");
/* Load all necessary kvm symbols */
/* Load all necessary kvm symbols */
if (!live)
kresolve_list(nl);
}
if (xflag && Tflag)
xo_errx(EX_USAGE, "-x and -T are incompatible, pick one.");
@ -739,9 +732,6 @@ kvmd_init(void)
return (0);
kvmd = kvm_openfiles(nlistf, memf, NULL, O_RDONLY, errbuf);
if (setgid(getgid()) != 0)
xo_err(EX_OSERR, "setgid");
if (kvmd == NULL) {
xo_warnx("kvm not available: %s", errbuf);
return (-1);