Date: Tue, 28 Jun 2005 19:12:24 GMT From: Andrew Reisse <areisse@FreeBSD.org> To: Perforce Change Reviews <perforce@freebsd.org> Subject: PERFORCE change 79092 for review Message-ID: <200506281912.j5SJCOvd096816@repoman.freebsd.org>
next in thread | raw e-mail | index | archive | help
http://perforce.freebsd.org/chv.cgi?CH=79092 Change 79092 by areisse@areisse_ibook on 2005/06/28 19:11:25 Sedarwin policy: -checkpolicy needs to be told to use version 17 -sebsd_migscs (mach msgid->security class mapping table) should be installed with the policy (To have it loaded by the kernel, use OF variable load_sebsd_migscs=sebsd_migscs) -Add a simple use of the automated mach message access checks. Use boolean "lookups" to enable or disable the prboot command. Affected files ... .. //depot/projects/trustedbsd/sedarwin7/src/sedarwin/policy/Makefile#4 edit .. //depot/projects/trustedbsd/sedarwin7/src/sedarwin/policy/rules#3 edit Differences ... ==== //depot/projects/trustedbsd/sedarwin7/src/sedarwin/policy/Makefile#4 (text+ko) ==== @@ -15,7 +15,7 @@ cat $(INPUTS) > policy.conf $(POLICY): policy.conf - ../programs/checkpolicy/checkpolicy -o $(POLICY) policy.conf + ../programs/checkpolicy/checkpolicy -c 17 -o $(POLICY) policy.conf rules.m4: rules m4 -Imacros -s rules > rules.m4 @@ -35,16 +35,17 @@ install: $(INSTALL) -o ${BINOWN} -g ${BINGRP} -m 644 ${POLICY} ${DESTDIR} + $(INSTALL) -o ${BINOWN} -g ${BINGRP} -m 644 sebsd_migscs ${DESTDIR} $(INSTALL) -o ${BINOWN} -g ${BINGRP} -m 700 ${SCRIPTS} ${DESTDIR}/private/etc/sedarwin (cd $(CURDIR)/..; tar -cf - policy) | (cd $(DESTDIR)/private/etc/sedarwin/; tar -xf -) cp -f Makefile.install $(DESTDIR)/private/etc/sedarwin/policy/Makefile - # Mig security classes and access vectors DEFS = $(DARWIN_ROOT)/system_cmds/mach_init.tproj/bootstrap.defs mig_msgids: $(DEFS) + echo > $@ for i in $(DEFS); do $(MIG) -user /dev/null -server /dev/null -header /dev/null -sheader /dev/null -flasksc `basename $$i .defs`.flask $$i; cat `basename $$i .defs`.flask >> $@; done mig_access_vectors: mig_msgids @@ -55,4 +56,4 @@ grep '^class' $< > $@ sebsd_migscs: flask/security_classes mig_msgids - cat flask/security_classes mig_msgids | perl migscs.pl+ cat flask/security_classes mig_msgids | perl migscs.pl ==== //depot/projects/trustedbsd/sedarwin7/src/sedarwin/policy/rules#3 (text+ko) ==== @@ -121,6 +121,7 @@ allow domain2 self:mach_task set_special_port; allow domain2 self:mi_bootstrap { bootstrap_look_up }; allow domain2 root_t:dir { search getattr read }; +allow domain2 self:process getsched; allow kernel_d domain2:mach_port { send make_send copy_send }; allow domain2 file:{file lnk_file sock_file fifo_file} {create_file_perms execute }; @@ -175,6 +176,7 @@ #type_change loginwindow_d loginwindow_d:mach_names user_names_t; #XXX allow init_d init_d:mach_port relabelfrom; allow init_d boot_names_t:mach_port relabelto; +allow init_d {loginwindow_d windowserver_d}:mach_port relabelto; allow init_d user_names_t:mach_port { copy_send relabelto }; allow_mach_ipc(systemstarter_d,unlabeled_t); @@ -309,3 +311,8 @@ user_sys_access(user_d,user_names_t); user_sys_access(protected_d,user_names_t); user_sys_access(user_secret_d,user_names_t); # can't use other names types yet + +bool lookups false; +if (lookups) { +allow user_d {init_d systemstarter_d loginwindow_d user_d}:mi_bootstrap bootstrap_info; +}
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200506281912.j5SJCOvd096816>