PR23359: impose security constraints on @kderef, @kregister

* parse.cxx: add privilege check for @kderef and @kregister
* testsuite/parseko/at_kderef.stp: New file to test privilege check
* testsuite/parseko/at_kregister.stp: New file to test privilege check
* testsuite/parseok/at_kderef.stp: New file to test privilege check
* testsuite/parseok/at_kregister.stp: New file to test privilege check

diff --git a/parse.cxx b/parse.cxx
index f0e018aabcad0b69edb7dae444d28b2433772185..751f56add84adb586bede6ee9af82ca5c7f374f1 100644 (file)
--- a/parse.cxx
+++ b/parse.cxx
@@ -4212,6 +4212,9 @@ expression* parser::parse_target_register (const token* t)
   int64_t regno;
   treg->tok = t;
   treg->userspace_p = (t->content[1] == 'u');
+  if (! treg->userspace_p && ! privileged)
+    throw PARSE_ERROR (_("using @kregister operator not permitted; need stap -g"),
+                       false /* don't skip tokens for parse resumption */);
   expect_op("(");
   expect_number(regno);
   treg->regno = regno;
@@ -4226,6 +4229,9 @@ expression* parser::parse_target_deref (const token* t)
   int64_t size;
   tderef->tok = t;
   tderef->userspace_p = (t->content[1] == 'u');
+  if (! tderef->userspace_p && ! privileged)
+    throw PARSE_ERROR (_("using @kderef operator not permitted; need stap -g"),
+                       false /* don't skip tokens for parse resumption */);
   expect_op("(");
   expect_number(size);
   tderef->size = size;

diff --git a/testsuite/parseko/at_kderef.stp b/testsuite/parseko/at_kderef.stp
new file mode 100755 (executable)
index 0000000..3fcb3b2
--- /dev/null
+++ b/testsuite/parseko/at_kderef.stp
@@ -0,0 +1,3 @@
+#! stap -p1
+
+probe oneshot {        @kderef(4, ptr) }

diff --git a/testsuite/parseko/at_kregister.stp b/testsuite/parseko/at_kregister.stp
new file mode 100755 (executable)
index 0000000..e58902a
--- /dev/null
+++ b/testsuite/parseko/at_kregister.stp
@@ -0,0 +1,3 @@
+#! stap -p1
+
+probe oneshot { @kregister(0) }

diff --git a/testsuite/parseok/at_kderef.stp b/testsuite/parseok/at_kderef.stp
new file mode 100755 (executable)
index 0000000..51f3d29
--- /dev/null
+++ b/testsuite/parseok/at_kderef.stp
@@ -0,0 +1,3 @@
+#! stap -gp1
+
+probe oneshot { @kderef(4, ptr) }

diff --git a/testsuite/parseok/at_kregister.stp b/testsuite/parseok/at_kregister.stp
new file mode 100755 (executable)
index 0000000..69b659c
--- /dev/null
+++ b/testsuite/parseok/at_kregister.stp
@@ -0,0 +1,3 @@
+#! stap -gp1
+
+probe oneshot { @kregister(0) }