From owner-p4-projects@FreeBSD.ORG Tue Jun 28 19:12:25 2005 Return-Path: X-Original-To: p4-projects@freebsd.org Delivered-To: p4-projects@freebsd.org Received: by hub.freebsd.org (Postfix, from userid 32767) id 0A9A216A420; Tue, 28 Jun 2005 19:12:25 +0000 (GMT) X-Original-To: perforce@freebsd.org Delivered-To: perforce@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id BDF2B16A41C for ; Tue, 28 Jun 2005 19:12:24 +0000 (GMT) (envelope-from areisse@nailabs.com) Received: from repoman.freebsd.org (repoman.freebsd.org [216.136.204.115]) by mx1.FreeBSD.org (Postfix) with ESMTP id A1AA943D58 for ; Tue, 28 Jun 2005 19:12:24 +0000 (GMT) (envelope-from areisse@nailabs.com) Received: from repoman.freebsd.org (localhost [127.0.0.1]) by repoman.freebsd.org (8.13.1/8.13.1) with ESMTP id j5SJCOnt096819 for ; Tue, 28 Jun 2005 19:12:24 GMT (envelope-from areisse@nailabs.com) Received: (from perforce@localhost) by repoman.freebsd.org (8.13.1/8.13.1/Submit) id j5SJCOvd096816 for perforce@freebsd.org; Tue, 28 Jun 2005 19:12:24 GMT (envelope-from areisse@nailabs.com) Date: Tue, 28 Jun 2005 19:12:24 GMT Message-Id: <200506281912.j5SJCOvd096816@repoman.freebsd.org> X-Authentication-Warning: repoman.freebsd.org: perforce set sender to areisse@nailabs.com using -f From: Andrew Reisse To: Perforce Change Reviews Cc: Subject: PERFORCE change 79092 for review X-BeenThere: p4-projects@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: p4 projects tree changes List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Jun 2005 19:12:25 -0000 http://perforce.freebsd.org/chv.cgi?CH=79092 Change 79092 by areisse@areisse_ibook on 2005/06/28 19:11:25 Sedarwin policy: -checkpolicy needs to be told to use version 17 -sebsd_migscs (mach msgid->security class mapping table) should be installed with the policy (To have it loaded by the kernel, use OF variable load_sebsd_migscs=sebsd_migscs) -Add a simple use of the automated mach message access checks. Use boolean "lookups" to enable or disable the prboot command. Affected files ... .. //depot/projects/trustedbsd/sedarwin7/src/sedarwin/policy/Makefile#4 edit .. //depot/projects/trustedbsd/sedarwin7/src/sedarwin/policy/rules#3 edit Differences ... ==== //depot/projects/trustedbsd/sedarwin7/src/sedarwin/policy/Makefile#4 (text+ko) ==== @@ -15,7 +15,7 @@ cat $(INPUTS) > policy.conf $(POLICY): policy.conf - ../programs/checkpolicy/checkpolicy -o $(POLICY) policy.conf + ../programs/checkpolicy/checkpolicy -c 17 -o $(POLICY) policy.conf rules.m4: rules m4 -Imacros -s rules > rules.m4 @@ -35,16 +35,17 @@ install: $(INSTALL) -o ${BINOWN} -g ${BINGRP} -m 644 ${POLICY} ${DESTDIR} + $(INSTALL) -o ${BINOWN} -g ${BINGRP} -m 644 sebsd_migscs ${DESTDIR} $(INSTALL) -o ${BINOWN} -g ${BINGRP} -m 700 ${SCRIPTS} ${DESTDIR}/private/etc/sedarwin (cd $(CURDIR)/..; tar -cf - policy) | (cd $(DESTDIR)/private/etc/sedarwin/; tar -xf -) cp -f Makefile.install $(DESTDIR)/private/etc/sedarwin/policy/Makefile - # Mig security classes and access vectors DEFS = $(DARWIN_ROOT)/system_cmds/mach_init.tproj/bootstrap.defs mig_msgids: $(DEFS) + echo > $@ for i in $(DEFS); do $(MIG) -user /dev/null -server /dev/null -header /dev/null -sheader /dev/null -flasksc `basename $$i .defs`.flask $$i; cat `basename $$i .defs`.flask >> $@; done mig_access_vectors: mig_msgids @@ -55,4 +56,4 @@ grep '^class' $< > $@ sebsd_migscs: flask/security_classes mig_msgids - cat flask/security_classes mig_msgids | perl migscs.pl+ cat flask/security_classes mig_msgids | perl migscs.pl ==== //depot/projects/trustedbsd/sedarwin7/src/sedarwin/policy/rules#3 (text+ko) ==== @@ -121,6 +121,7 @@ allow domain2 self:mach_task set_special_port; allow domain2 self:mi_bootstrap { bootstrap_look_up }; allow domain2 root_t:dir { search getattr read }; +allow domain2 self:process getsched; allow kernel_d domain2:mach_port { send make_send copy_send }; allow domain2 file:{file lnk_file sock_file fifo_file} {create_file_perms execute }; @@ -175,6 +176,7 @@ #type_change loginwindow_d loginwindow_d:mach_names user_names_t; #XXX allow init_d init_d:mach_port relabelfrom; allow init_d boot_names_t:mach_port relabelto; +allow init_d {loginwindow_d windowserver_d}:mach_port relabelto; allow init_d user_names_t:mach_port { copy_send relabelto }; allow_mach_ipc(systemstarter_d,unlabeled_t); @@ -309,3 +311,8 @@ user_sys_access(user_d,user_names_t); user_sys_access(protected_d,user_names_t); user_sys_access(user_secret_d,user_names_t); # can't use other names types yet + +bool lookups false; +if (lookups) { +allow user_d {init_d systemstarter_d loginwindow_d user_d}:mi_bootstrap bootstrap_info; +}