[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]
Re: bin/54971: sockstat command output incorrect for normal user
The following reply was made to PR bin/54971; it has been noted by GNATS.
From: scole_mail <scole_mail%gmx.com@localhost>
Subject: Re: bin/54971: sockstat command output incorrect for normal user
Date: Mon, 24 Aug 2020 19:04:43 -0700
I've been looking into this a little and I believe it is permission
issue that changed between 8.0 and 9.0. I see a sysctl variable
kern.expose_address was added
to allow fstat/pstat -f/netstat to read kernel-protected addresses as a
normal user when enabled.
But sockstat still can't read those protected fields even with
kern.expose_address=3D1. I think there are at least 2 reasons.
1) Unlike the other *stat commands (fstat/netstat/pstat/...), sockstat
is not set-group-id-on-execution.
2) src/usr.bin/sockstat/sockstat.c is only using sysctls
(prog_sysctlnametomib & prog_sysctl) to populate its file structures,
and some fields (kinfo_file->ki_fdata) are unreadable, even with
kern.expose_address=3D1. For example, ki_fdata is always read as "0",
and since there is hash of sockets addresses used for displaying the
"PROTO LOCAL ADDRESS FOREIGN ADDRESS"
fields, it doesn't work correctly.
So I tried making sockstat match other permissions of
-r-xr-sr-x 1 root kmem
That didn't work by itself, even when whole sockstat exe ran as
setegid(getegid()). But, if I do a call to kvm_open, don't even use the
descriptor, then close it (right after parsing input args):
kd =3D kvm_openfiles(NULL, NULL, NULL, O_RDONLY, buf);
if (kd =3D=3D NULL)
errx(1, "%s", buf);
then the sysctl calls work correctly, and the sockstat program runs as
Is there "proper" way to give these sysctl's enough permissions to read
kernel addresses, or should sockstat really be using for kvm(3)?
Why does kvm_open/kvm_close/sysctl even work at all?
I know sysctl is only for live kernels, but I saw some of the other
*stat (pstat/fstat/...) use both sysctl and kvm, wouldn't it be easier
to maintain just to use only kvm?
This is was all tested on NetBSD 9.
Main Index |
Thread Index |