Project

General

Profile

Bug #2915

DTrace in a zone should see "cpu", "curpsinfo", et al

Added by Joshua M. Clulow almost 8 years ago. Updated about 6 years ago.

Status:
Resolved
Priority:
Normal
Category:
DTrace
Start date:
2012-06-22
Due date:
% Done:

0%

Estimated time:
Difficulty:
Medium
Tags:

Description

Users in zones cannot have the dtrace_kernel privilege, and thus cannot presently gain access to potentially interesting members of the DTrace variables curpsinfo, curlwpsinfo and curcpu.

Users with only dtrace_proc (and thus users in appropriately configured non-global zones) should be able to read any members of these variables that do not represent privilege escalation. This change enables that behaviour by allowing loads from restricted ranges within the current thread's proc_t, cred_t, etc.

Upstream commit:

commit 557678d88bab59034685d166fa3f1337176cfce3
Author: Bryan Cantrill <bryan@joyent.com>
Date:   Thu May 31 08:16:34 2012 +0000

    OS-430 dtrace in a zone can't see "cpu" 
    OS-535 want curpsinfo->pr_dmodel inside zones

and on github: https://github.com/joyent/illumos-joyent/commit/557678d88bab59034685d166fa3f1337176cfce3

History

#2

Updated by Electric Monk about 6 years ago

git commit b0f673c4626e4cb1db7785287eaeed2731dfefe8

Author: Bryan Cantrill <bryan@joyent.com>

2915 DTrace in a zone should see "cpu", "curpsinfo", et al
2916 DTrace in a zone should be able to access fds[]
2917 DTrace in a zone should have limited provider access
Reviewed by: Joshua M. Clulow <josh@sysmgr.org>
Reviewed by: Adam Leventhal <ahl@delphix.com>
Approved by: Gordon Ross <gwr@nexenta.com>

#3

Updated by Rich Lowe about 6 years ago

  • Status changed from New to Resolved

Also available in: Atom PDF