From owner-p4-projects Thu Oct 31 8: 7:26 2002 Delivered-To: p4-projects@freebsd.org Received: by hub.freebsd.org (Postfix, from userid 32767) id 789D737B404; Thu, 31 Oct 2002 08:07:23 -0800 (PST) Delivered-To: perforce@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 119BC37B401 for ; Thu, 31 Oct 2002 08:07:23 -0800 (PST) Received: from repoman.freebsd.org (repoman.freebsd.org [216.136.204.115]) by mx1.FreeBSD.org (Postfix) with ESMTP id A21DB43E77 for ; Thu, 31 Oct 2002 08:07:22 -0800 (PST) (envelope-from bb+lists.freebsd.perforce@cyrus.watson.org) Received: from repoman.freebsd.org (localhost [127.0.0.1]) by repoman.freebsd.org (8.12.6/8.12.6) with ESMTP id g9VG62mV090060 for ; Thu, 31 Oct 2002 08:06:02 -0800 (PST) (envelope-from bb+lists.freebsd.perforce@cyrus.watson.org) Received: (from perforce@localhost) by repoman.freebsd.org (8.12.6/8.12.6/Submit) id g9VG61ZA090057 for perforce@freebsd.org; Thu, 31 Oct 2002 08:06:01 -0800 (PST) Date: Thu, 31 Oct 2002 08:06:01 -0800 (PST) Message-Id: <200210311606.g9VG61ZA090057@repoman.freebsd.org> X-Authentication-Warning: repoman.freebsd.org: perforce set sender to bb+lists.freebsd.perforce@cyrus.watson.org using -f From: Robert Watson Subject: PERFORCE change 20479 for review To: Perforce Change Reviews Sender: owner-p4-projects@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG http://perforce.freebsd.org/chv.cgi?CH=20479 Change 20479 by rwatson@rwatson_tislabs on 2002/10/31 08:05:34 Implement time setting protection for mac_biba, mac_none, and mac_test. Affected files ... .. //depot/projects/trustedbsd/mac/sys/security/mac_biba/mac_biba.c#175 edit .. //depot/projects/trustedbsd/mac/sys/security/mac_none/mac_none.c#99 edit .. //depot/projects/trustedbsd/mac/sys/security/mac_test/mac_test.c#75 edit Differences ... ==== //depot/projects/trustedbsd/mac/sys/security/mac_biba/mac_biba.c#175 (text+ko) ==== @@ -1895,6 +1895,23 @@ return (0); } + +static int +mac_biba_check_system_settime(struct ucred *cred) +{ + struct mac_biba *subj; + + if (!mac_biba_enabled) + return (0); + + subj = SLOT(&cred->cr_label); + + if (!mac_biba_subject_privileged(subj)) + return (EPERM); + + return (0); +} + static int mac_biba_check_system_swapon(struct ucred *cred, struct vnode *vp, struct label *label) @@ -2634,6 +2651,7 @@ .mpo_check_socket_relabel = mac_biba_check_socket_relabel, .mpo_check_socket_visible = mac_biba_check_socket_visible, .mpo_check_system_acct = mac_biba_check_system_acct, + .mpo_check_system_settime = mac_biba_check_system_settime, .mpo_check_system_swapon = mac_biba_check_system_swapon, .mpo_check_system_sysctl = mac_biba_check_system_sysctl, .mpo_check_vnode_access = mac_biba_check_vnode_open, ==== //depot/projects/trustedbsd/mac/sys/security/mac_none/mac_none.c#99 (text+ko) ==== @@ -668,6 +668,13 @@ } static int +mac_none_check_system_settime(struct ucred *cred) +{ + + return (0); +} + +static int mac_none_check_system_swapon(struct ucred *cred, struct vnode *vp, struct label *label) { @@ -1037,6 +1044,7 @@ .mpo_check_socket_visible = mac_none_check_socket_visible, .mpo_check_system_acct = mac_none_check_system_acct, .mpo_check_system_reboot = mac_none_check_system_reboot, + .mpo_check_system_settime = mac_none_check_system_settime, .mpo_check_system_swapon = mac_none_check_system_swapon, .mpo_check_system_sysctl = mac_none_check_system_sysctl, .mpo_check_vnode_access = mac_none_check_vnode_access, ==== //depot/projects/trustedbsd/mac/sys/security/mac_test/mac_test.c#75 (text+ko) ==== @@ -1064,6 +1064,13 @@ } static int +mac_test_check_system_settime(struct ucred *cred) +{ + + return (0); +} + +static int mac_test_check_system_swapon(struct ucred *cred, struct vnode *vp, struct label *label) { @@ -1434,6 +1441,7 @@ .mpo_check_socket_visible = mac_test_check_socket_visible, .mpo_check_system_acct = mac_test_check_system_acct, .mpo_check_system_reboot = mac_test_check_system_reboot, + .mpo_check_system_settime = mac_test_check_system_settime, .mpo_check_system_swapon = mac_test_check_system_swapon, .mpo_check_system_sysctl = mac_test_check_system_sysctl, .mpo_check_vnode_access = mac_test_check_vnode_access, To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe p4-projects" in the body of the message