On Mon, Sep 29, 2014 at 06:53:08PM +0000, Brooks Davis wrote:
> On Mon, Sep 29, 2014 at 08:20:08PM +0200, Luigi Rizzo wrote:
...
> > The nm_open() (which includes open and mmap) occurs before the
> > cap_enter() call, and poll() works fine until we do the
> > cap_enter()/cap_sandboxed() calls.
> >
> > I was wondering whether I should somewhat annotate the file descriptor
> > (in the netmap kernel module) indicating that it is right to access it
> > after cap_enter(). poll() returns 1 and errno=0
> > when polling for POLLIN on the netmap file descriptor,
> > while it should return 0 (there is no traffic queued).
> >
> > I haven't investigated in detail but it almost looks like the
> > underlying netmap_poll() in the device driver is not called.
>
> Ah, that's it. The problem is that we're limiting the pcap file
> descriptors to CAP_READ. It looks like you'd need to add CAP_EVENT to
> that list. Look for cap_rights_init and cap_rights_limit pairs to find
> the right place(s) to modify.
>
The following works for me with the netmap file descriptor,
but I am not sure if it is too tight or too loose.
Also I don't understand why regular bpf did not need CAP_EVENT
(I presume it worked correctly or people would have complained ?)
cheers
luigi
Index: ../../contrib/tcpdump/tcpdump.c
===================================================================
--- ../../contrib/tcpdump/tcpdump.c (revision 269180)
+++ ../../contrib/tcpdump/tcpdump.c (working copy)
@@ -1486,7 +1486,7 @@
if (RFileName == NULL && VFileName == NULL) {
static const unsigned long cmds[] = { BIOCGSTATS };
- cap_rights_init(&rights, CAP_IOCTL, CAP_READ);
+ cap_rights_init(&rights, CAP_IOCTL, CAP_READ, CAP_EVENT);
if (cap_rights_limit(pcap_fileno(pd), &rights) < 0 &&
errno != ENOSYS) {
error("unable to limit pcap descriptor");
@@ -1519,7 +1519,7 @@
if (p == NULL)
error("%s", pcap_geterr(pd));
#ifdef __FreeBSD__
- cap_rights_init(&rights, CAP_SEEK, CAP_WRITE);
+ cap_rights_init(&rights, CAP_SEEK, CAP_WRITE, CAP_EVENT);
if (cap_rights_limit(fileno(pcap_dump_file(p)), &rights) < 0 &&
errno != ENOSYS) {
error("unable to limit dump descriptor");
@@ -1662,7 +1662,7 @@
if (pd == NULL)
error("%s", ebuf);
#ifdef __FreeBSD__
- cap_rights_init(&rights, CAP_READ);
+ cap_rights_init(&rights, CAP_READ, CAP_EVENT);
if (cap_rights_limit(fileno(pcap_file(pd)),
&rights) < 0 && errno != ENOSYS) {
error("unable to limit pcap
descriptor");
_______________________________________________
freebsd-current@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-current
To unsubscribe, send any mail to "freebsd-current-unsubscr...@freebsd.org"
