From c71e336230ebd96f3617047923192a3b49f7befe Mon Sep 17 00:00:00 2001
From: Jamie Gritton <jamie@FreeBSD.org>
Date: Fri, 5 Jul 2013 21:31:16 +0000
Subject: [PATCH] Add new privileges, PRIV_KMEM_READ and PRIV_KMEM_WRITE, used
 in opening /dev/kmem and /dev/mem (in addition to traditional file permission
 checks). PRIV_KMEM_READ is different from other PRIV_* checks in that it's
 allowed by default.

Reviewed by:	kib, mckusick
---
 sys/dev/mem/memdev.c | 11 +++++++++--
 sys/kern/kern_priv.c |  9 +++++++++
 sys/sys/priv.h       |  6 ++++++
 3 files changed, 24 insertions(+), 2 deletions(-)

diff --git a/sys/dev/mem/memdev.c b/sys/dev/mem/memdev.c
index 28ed6ebc4e9..37bad1538f7 100644
--- a/sys/dev/mem/memdev.c
+++ b/sys/dev/mem/memdev.c
@@ -37,6 +37,7 @@ __FBSDID("$FreeBSD$");
 #include <sys/memrange.h>
 #include <sys/module.h>
 #include <sys/mutex.h>
+#include <sys/priv.h>
 #include <sys/proc.h>
 #include <sys/signalvar.h>
 #include <sys/systm.h>
@@ -67,8 +68,14 @@ memopen(struct cdev *dev __unused, int flags, int fmt __unused,
 {
 	int error = 0;
 
-	if (flags & FWRITE)
-		error = securelevel_gt(td->td_ucred, 0);
+	if (flags & FREAD)
+		error = priv_check(td, PRIV_KMEM_READ);
+	if (flags & FWRITE) {
+		if (error == 0)
+			error = priv_check(td, PRIV_KMEM_WRITE);
+		if (error == 0)
+			error = securelevel_gt(td->td_ucred, 0);
+	}
 
 	return (error);
 }
diff --git a/sys/kern/kern_priv.c b/sys/kern/kern_priv.c
index fcd599393be..204e00bb95e 100644
--- a/sys/kern/kern_priv.c
+++ b/sys/kern/kern_priv.c
@@ -141,6 +141,15 @@ priv_check_cred(struct ucred *cred, int priv, int flags)
 		}
 	}
 
+	/*
+	 * Writes to kernel memory are a typical root-only operation,
+	 * but non-root users are expected to be able to read it.
+	 */
+	if (priv == PRIV_KMEM_READ) {
+		error = 0;
+		goto out;
+	}
+
 	/*
 	 * Now check with MAC, if enabled, to see if a policy module grants
 	 * privilege.
diff --git a/sys/sys/priv.h b/sys/sys/priv.h
index b984f1a0beb..de3f3bd03b1 100644
--- a/sys/sys/priv.h
+++ b/sys/sys/priv.h
@@ -493,6 +493,12 @@
 #define	PRIV_RCTL_ADD_RULE	673
 #define	PRIV_RCTL_REMOVE_RULE	674
 
+/*
+ * Kernel memory privileges.
+ */
+#define	PRIV_KMEM_READ		680	/* Read from kernel memory. */
+#define	PRIV_KMEM_WRITE		681	/* Write to kernel memory. */
+
 /*
  * Track end of privilege list.
  */