sys/kern/kern_unveil.c

533 unveil_flagmatch(struct nameidata *ni, u_char flags)
539 	if (ni->ni_unveil & UNVEIL_READ) {
545 	if (ni->ni_unveil & UNVEIL_WRITE) {
551 	if (ni->ni_unveil & UNVEIL_EXEC) {
557 	if (ni->ni_unveil & UNVEIL_CREATE) {
595 unveil_start_relative(struct proc *p, struct nameidata *ni, struct vnode *dp)
620 		ni->ni_unveil_match = uv;
628 unveil_check_component(struct proc *p, struct nameidata *ni, struct vnode *dp)
633 	if (ni->ni_pledge == PLEDGE_UNVEIL || pr->ps_uvpaths == NULL)
635 	if (ni->ni_cnd.cn_flags & BYPASSUNVEIL)
638 	if (ni->ni_cnd.cn_flags & ISDOTDOT) {
642 		uv = unveil_covered(ni->ni_unveil_match, dp, p);
645 		if (ni->ni_unveil_match && ni->ni_unveil_match->uv_vp == dp)
646 			ni->ni_unveil_match = NULL;
652 		ni->ni_unveil_match = uv;
664 unveil_check_final(struct proc *p, struct nameidata *ni)
670 	if (ni->ni_pledge == PLEDGE_UNVEIL || pr->ps_uvpaths == NULL)
673 	if (ni->ni_cnd.cn_flags & BYPASSUNVEIL) {
680 	if (ni->ni_vp != NULL && ni->ni_vp->v_type == VDIR) {
682 		uv = unveil_lookup(ni->ni_vp, pr, NULL);
685 			    pr->ps_comm, pr->ps_pid, ni->ni_vp);
688 				ni->ni_unveil_match = uv;
691 		if (!unveil_flagmatch(ni, uv->uv_flags)) {
694 			    pr->ps_comm, pr->ps_pid, ni->ni_vp);
705 		    pr->ps_comm, pr->ps_pid, ni->ni_cnd.cn_nameptr,
712 	uv = unveil_lookup(ni->ni_dvp, pr, NULL);
715 		    pr->ps_comm, pr->ps_pid, ni->ni_dvp);
719 	if ((tname = unveil_namelookup(uv, ni->ni_cnd.cn_nameptr)) == NULL) {
723 		    ni->ni_cnd.cn_nameptr, ni->ni_dvp);
726 		if (!unveil_flagmatch(ni, uv->uv_flags)) {
731 			    ni->ni_cnd.cn_nameptr, ni->ni_dvp);
746 			ni->ni_unveil_match = uv;
751 		    pr->ps_comm, pr->ps_pid, ni->ni_cnd.cn_nameptr,
756 	if (!unveil_flagmatch(ni, tname->un_flags)) {
775 	for (uv = ni->ni_unveil_match; uv != NULL; uv = nuv) {
776 		if (unveil_flagmatch(ni, uv->uv_flags)) {
779 			    ni->ni_cnd.cn_nameptr, uv->uv_vp);