doc/website/static/security/patches/SA-21:04/jail_remove.patch
2021-02-23 21:53:31 -08:00

66 lines
1.5 KiB
Diff

--- sys/kern/kern_fork.c.orig
+++ sys/kern/kern_fork.c
@@ -1138,6 +1138,12 @@
PROC_UNLOCK(p);
}
+ /*
+ * If the prison was killed mid-fork, die along with it.
+ */
+ if (td->td_ucred->cr_prison->pr_flags & PR_REMOVE)
+ exit1(td, 0, SIGKILL);
+
userret(td, frame);
#ifdef KTRACE
--- sys/kern/kern_jail.c.orig
+++ sys/kern/kern_jail.c
@@ -1768,6 +1768,7 @@
}
}
pr->pr_flags = (pr->pr_flags & ~ch_flags) | pr_flags;
+ pr->pr_flags &= ~PR_REMOVE;
mtx_unlock(&pr->pr_mtx);
#ifdef RACCT
@@ -2306,6 +2307,12 @@
struct proc *p;
int deuref;
+ /*
+ * Mark the prison as doomed, so it doesn't accidentally come back
+ * to life. It may still be explicitly brought back by jail_set(2).
+ */
+ pr->pr_flags |= PR_REMOVE;
+
/* If the prison was persistent, it is not anymore. */
deuref = 0;
if (pr->pr_flags & PR_PERSIST) {
@@ -2450,6 +2457,17 @@
#endif
prison_deref(oldcred->cr_prison, PD_DEREF | PD_DEUREF);
crfree(oldcred);
+
+ /*
+ * If the prison was killed while changing credentials, die along
+ * with it.
+ */
+ if (pr->pr_flags & PR_REMOVE) {
+ PROC_LOCK(p);
+ kern_psignal(p, SIGKILL);
+ PROC_UNLOCK(p);
+ }
+
return (0);
e_unlock:
--- sys/sys/jail.h.orig
+++ sys/sys/jail.h
@@ -213,6 +213,7 @@
/* primary jail address. */
/* Internal flag bits */
+#define PR_REMOVE 0x01000000 /* In process of being removed */
#define PR_IP4 0x02000000 /* IPv4 restricted or disabled */
/* by this jail or an ancestor */
#define PR_IP6 0x04000000 /* IPv6 restricted or disabled */