bhyveload: limit rights on the dirfds we create

[kevans]

Summary

In neither case do we need write access to the directories we're working
with; userboot doesn't support fo_write on the host device, and the
bootfd is only ever needed for loader loading.

This improves on 8bf0882e18 ("bhyveload: enter capability mode [...]")
so that arbitrary code in the loader can't open writable fds to either
of the directories we need to maintain access to.

[imp]

Only time we need to write is to nextboot.conf... Since we don't support that from the userboot boot loader... this should be fine. We can punch a hole for nextboot.conf if we ever add that support.

[markj]

In D43315#987334, @imp wrote:

Only time we need to write is to nextboot.conf... Since we don't support that from the userboot boot loader... this should be fine. We can punch a hole for nextboot.conf if we ever add that support.

That's in the guest filesystem though, here we're dealing with the host filesystem. bhyveload+nextboot works fine today.

[jrtc27]

usr.sbin/bhyveload/bhyveload.c

894

Missed a space here

897–898

Isn't this just err(1, "...");? I guess copied from the existing open code?

[kevans]

usr.sbin/bhyveload/bhyveload.c

894

Will fix in the morning, thanks

897–898

Yeah, I tried to keep it consistent with the rest of the area... somewhere around just after the getopt loop it goes from err -> perror + exit (though I wouldn't be surprised if one could provide counterexamples), we should really make it all consistent.

[markj]

usr.sbin/bhyveload/bhyveload.c

758

CAP_SEEK is probably also worth having? (Can be added by changing CAP_READ to CAP_PREAD.)

896

Again, I'd suggest using CAP_PREAD to avoid surprises.

[kevans]

usr.sbin/bhyveload/bhyveload.c

758

Sure- I missed that we actually have an lseek() callback for host: fs; we don't seem to use it in my normal operation, but that doesn't mean it's unused.

re: /boot, it doesn't look like rtld will try to do any seeking on dlopen'd objects, but yeah- I don't see the harm in allowing it.