看板FB_security
标 题Re: Request for review: Sandboxing dhclient using Capsicum.
发信站NCTU CS FreeBSD Server (Tue Jun 11 02:07:17 2013)
转信站ptt!csnews.cs.nctu!news.cs.nctu!.cs.nctucs.nctu!!freebsdfreebsd.org!ow
On Sun, Jun 09, 2013 at 12:33:46AM +0200, Pawel Jakub Dawidek wrote:
> I'd appreciate any review, especially security audit of the proposed
> changes. The new and most critical function is probably send_packet_priv().
I've looked over the diff and not found any significant issues, but have
a few comments in order of most to least important.
In change 229477 using a cached hostname may change behavior if the host
is renamed as a result of dhclient operation. The new behavior might be
more correct, at least it would be if we reliably restored the host name
on termination. I think the change is fine, but we should be keep an
eye out for problem reports.
In change 229476 I noticed there is a constant 0x1fff that you've moved
around. It was already there, but it seems like an unnecessary magic
number.
In the send_packet_* function declarations in dhcpd.h, you have included
variable names which is inconsistent with the surrounding definitions.
I saw a few style/whitespace fixed mixed in that should be batched,
probably before the substantive commits.
-- Brooks
_______________________________________________
[email protected] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "
[email protected]"