Changeset 39133 in vbox for trunk/src/VBox/HostDrivers/Support

Timestamp:

Oct 27, 2011 5:54:33 PM (14 years ago)

Author:

vboxsync

svn:sync-xref-src-repo-rev:

74583

Message:

SUPR3HardenedVerify.cpp: tightened the Mac OS X and PC-BSD 9 hacks.

File:

• trunk/src/VBox/HostDrivers/Support/SUPR3HardenedVerify.cpp (modified) (2 diffs)

trunk/src/VBox/HostDrivers/Support/SUPR3HardenedVerify.cpp

@@ -1128 +1128 @@
  *                              directory (only used for grand parent
  *                              directories).
- * @param   pszPath             The path to the object. (For error messages
- *                              only.)
+ * @param   pszPath             The path to the object. For error messages and
+ *                              securing a couple of hacks.
  * @param   pErrInfo            The error info structure.
  */
@@ -1190 +1190 @@
            full access. So, to work around we relax the hardening a bit and
            permit grand parents and beyond to be group writable by admin. */
-        bool fBad = !fRelaxed || pFsObjState->Stat.st_gid != 80 /*admin*/; /** @todo dynamically resolve the admin group? */
+        /** @todo dynamically resolve the admin group? */
+        bool fBad = !fRelaxed || pFsObjState->Stat.st_gid != 80 /*admin*/ || strcmp(pszPath, "/Applications");
 
 #elif defined(RT_OS_FREEBSD)
-        /* HACK ALERT: PC-BSD 9 has group-writable application directory,
-           similar to OS X and their /Applications directory (see above).
-           On FreeBSD root is normally the only member of this group. */
-        /** @todo Can we test for fRelaxed here like on the mac or is the 'operator'
-         *        group the owner of the immediate installation directory? More
-         *        details would be greatly appreciated as this HACK affects real FreeBSD
-         *        as well as the PC-BSD fork! */
-        bool fBad = pFsObjState->Stat.st_gid != 5 /*operator*/;
+        /* HACK ALERT: PC-BSD 9 has group-writable /usr/pib directory which is
+           similar to /Applications on OS X (see above).
+           On FreeBSD root is normally the only member of this group, on
+           PC-BSD the default user is a member. */
+        /** @todo dynamically resolve the operator group? */
+        bool fBad = !fRelaxed || pFsObjState->Stat.st_gid != 5 /*operator*/ || strcmp(pszPath, "/usr/pbi");
         NOREF(fRelaxed);
 #else