DragonFly BSD
DragonFly kernel List (threaded) for 2013-07
[Date Prev][Date Next]  [Thread Prev][Thread Next]  [Date Index][Thread Index]

Re: [GSOC] capsicum week6 report


From: Muhammad Nuzaihan Bin Kamal Luddin <muhammad@xxxxxxxxxxxxxxx>
Date: Mon, 29 Jul 2013 15:28:27 +0800

This is a multi-part message in MIME format.
--------------070007040904080902060208
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit

Thumbs up!. :)

On 07/29/2013 03:11 PM, Loganaden Velvindron wrote:
> Awesome man :-)
>
> Keep it up !
>
>
> On Mon, Jul 29, 2013 at 10:29 AM, Joris Giovannangeli 
> <joris@giovannangeli.fr <mailto:joris@giovannangeli.fr>> wrote:
>
>     Hi,
>
>     this week I've been stabilizing my work a bit more. The implementation
>     is still rough but "functionnal". I've finished the capability mode by
>     modifying the sycall path and the syscall table to check if a
>     syscall is
>     allowed in capability mode and return ECAPMODE if not. I've converted
>     most of the holdfp calls to check capability rights, but there is
>     still
>     some calls I must read more carefully to find which rights they need.
>     I've made the nlookup path return ECAPMODE when doing a non-relative
>     lookup. For now, the code is not perfect because i can leak
>     information
>     from outside the sandbox. Indeed, if an early error is returned, I
>     don't
>     check if the current namecache entry is still in sandbox and
>     return the
>     error (EEXIST, ENOENT, etc). This is a bug. I've been trying to modify
>     this behaviour, but for now, it's completely broken.
>     To test the work, i've ported the capsicum-enabled bzip2 a student has
>     done for FreeBSD during gsoc :
>     https://svnweb.freebsd.org/socsvn/soc2013/dpl/head/ . I've run it on a
>     vkernel, and it can compress and decompress files w/o troubles.
>
>     Joris
>
>
>
>
> -- 
> This message is strictly personal and the opinions expressed do not 
> represent those of my employers, either past or present.
>
>
>
>


-- 
Taqi Systems
269-J Jalan Panji
Kampung Chempaka, Kota Bharu, Kelantan 16100

Phone: +6097738657
Mobile: +60199788657

pub   4096R/4C77F88C 2013-04-06 [expires: 2015-04-06]
       Key fingerprint = 2FE1 87FA E775 2E05 CC0F  B3F6 3CB7 C65F 4C77
F88C
uid                  Muhammad Nuzaihan Bin Kamal Luddin
<muhammad@taqisystems.com>


--------------070007040904080902060208
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit

<html>
  <head>
    <meta content="text/html; charset=ISO-8859-1"
      http-equiv="Content-Type">
  </head>
  <body text="#000000" bgcolor="#FFFFFF">
    <div class="moz-cite-prefix">Thumbs up!. :)<br>
      <br>
      On 07/29/2013 03:11 PM, Loganaden Velvindron wrote:<br>
    </div>
    <blockquote
cite="mid:CAOp4FwQ7mZxsdCXd5Jtgdc9167=vpCuv9nwUQo=1eX3QkrZjKw@mail.gmail.com";
      type="cite">
      <div dir="ltr">Awesome man :-)
        <div><br>
        </div>
        <div>Keep it up !</div>
      </div>
      <div class="gmail_extra"><br>
        <br>
        <div class="gmail_quote">On Mon, Jul 29, 2013 at 10:29 AM, Joris
          Giovannangeli <span dir="ltr">&lt;<a moz-do-not-send="true"
              href="mailto:joris@giovannangeli.fr"; target="_blank">joris@giovannangeli.fr</a>&gt;</span>
          wrote:<br>
          <blockquote class="gmail_quote" style="margin:0 0 0
            .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi,<br>
            <br>
            this week I've been stabilizing my work a bit more. The
            implementation<br>
            is still rough but "functionnal". I've finished the
            capability mode by<br>
            modifying the sycall path and the syscall table to check if
            a syscall is<br>
            allowed in capability mode and return ECAPMODE if not. I've
            converted<br>
            most of the holdfp calls to check capability rights, but
            there is still<br>
            some calls I must read more carefully to find which rights
            they need.<br>
            I've made the nlookup path return ECAPMODE when doing a
            non-relative<br>
            lookup. For now, the code is not perfect because i can leak
            information<br>
            from outside the sandbox. Indeed, if an early error is
            returned, I don't<br>
            check if the current namecache entry is still in sandbox and
            return the<br>
            error (EEXIST, ENOENT, etc). This is a bug. I've been trying
            to modify<br>
            this behaviour, but for now, it's completely broken.<br>
            To test the work, i've ported the capsicum-enabled bzip2 a
            student has<br>
            done for FreeBSD during gsoc :<br>
            <a moz-do-not-send="true"
              href="https://svnweb.freebsd.org/socsvn/soc2013/dpl/head/";
              target="_blank">https://svnweb.freebsd.org/socsvn/soc2013/dpl/head/</a>
            . I've run it on a<br>
            vkernel, and it can compress and decompress files w/o
            troubles.<br>
            <span class="HOEnZb"><font color="#888888"><br>
                Joris<br>
                <br>
              </font></span></blockquote>
        </div>
        <br>
        <br clear="all">
        <div><br>
        </div>
        -- <br>
        <div dir="ltr">
          <div style="text-align:left">This message is strictly personal
            and the opinions expressed do not represent those of my
            employers, either past or present.</div>
          <br>
          <br>
          &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <br>
          <br>
        </div>
      </div>
    </blockquote>
    <br>
    <br>
    <pre class="moz-signature" cols="72">-- 
Taqi Systems
269-J Jalan Panji 
Kampung Chempaka, Kota Bharu, Kelantan 16100

Phone: +6097738657
Mobile: +60199788657

pub   4096R/4C77F88C 2013-04-06 [expires: 2015-04-06]
      Key fingerprint = 2FE1 87FA E775 2E05 CC0F  B3F6 3CB7 C65F 4C77
F88C
uid                  Muhammad Nuzaihan Bin Kamal Luddin
<a class="moz-txt-link-rfc2396E" href="mailto:muhammad@taqisystems.com";>&lt;muhammad@taqisystems.com&gt;</a></pre>
  </body>
</html>

--------------070007040904080902060208--



[Date Prev][Date Next]  [Thread Prev][Thread Next]  [Date Index][Thread Index]