From owner-p4-projects@FreeBSD.ORG Thu Oct 12 19:34:05 2006 Return-Path: X-Original-To: p4-projects@freebsd.org Delivered-To: p4-projects@freebsd.org Received: by hub.freebsd.org (Postfix, from userid 32767) id 2DB2F16A51E; Thu, 12 Oct 2006 19:34:05 +0000 (UTC) X-Original-To: perforce@freebsd.org Delivered-To: perforce@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id F274F16A51B for ; Thu, 12 Oct 2006 19:34:04 +0000 (UTC) (envelope-from millert@freebsd.org) Received: from repoman.freebsd.org (repoman.freebsd.org [216.136.204.115]) by mx1.FreeBSD.org (Postfix) with ESMTP id 3B7FF43D79 for ; Thu, 12 Oct 2006 19:34:04 +0000 (GMT) (envelope-from millert@freebsd.org) Received: from repoman.freebsd.org (localhost [127.0.0.1]) by repoman.freebsd.org (8.13.6/8.13.6) with ESMTP id k9CJY4tg067781 for ; Thu, 12 Oct 2006 19:34:04 GMT (envelope-from millert@freebsd.org) Received: (from perforce@localhost) by repoman.freebsd.org (8.13.6/8.13.4/Submit) id k9CJY3T0067768 for perforce@freebsd.org; Thu, 12 Oct 2006 19:34:03 GMT (envelope-from millert@freebsd.org) Date: Thu, 12 Oct 2006 19:34:03 GMT Message-Id: <200610121934.k9CJY3T0067768@repoman.freebsd.org> X-Authentication-Warning: repoman.freebsd.org: perforce set sender to millert@freebsd.org using -f From: Todd Miller To: Perforce Change Reviews Cc: Subject: PERFORCE change 107772 for review X-BeenThere: p4-projects@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: p4 projects tree changes List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 12 Oct 2006 19:34:05 -0000 http://perforce.freebsd.org/chv.cgi?CH=107772 Change 107772 by millert@millert_macbook on 2006/10/12 19:33:59 Fix handling of migscs data. We now install sebsd_migscs in the policy dir alongside the binary policy file which makes it possible to reload it via load_policy. Fix path to load_policy so "make reload" can work. Trim leading underscores from MiG class method names since checkpolicy requires names to start with a letter. Affected files ... .. //depot/projects/trustedbsd/sedarwin8/policies/sedarwin/refpolicy/Makefile#3 edit .. //depot/projects/trustedbsd/sedarwin8/policies/sedarwin/refpolicy/Rules.monolithic#4 edit .. //depot/projects/trustedbsd/sedarwin8/policies/sedarwin/refpolicy/migscs.pl#2 edit .. //depot/projects/trustedbsd/sedarwin8/policies/sedarwin/refpolicy/update_plist#4 edit Differences ... ==== //depot/projects/trustedbsd/sedarwin8/policies/sedarwin/refpolicy/Makefile#3 (text+ko) ==== @@ -76,7 +76,7 @@ SEMOD_PKG ?= $(BINDIR)/semodule_package SEMOD_LNK ?= $(BINDIR)/semodule_link SEMOD_EXP ?= $(BINDIR)/semodule_expand -LOADPOLICY ?= $(BINDIR)/load_policy +LOADPOLICY ?= $(SBINDIR)/load_policy SETFILES ?= $(BINDIR)/setfiles MIG ?= $(BINDIR)/mig endif @@ -624,21 +624,18 @@ endif endif -all: default sebsd_migscs +all: default $(mig_msgids): $(MIG_DEFS) echo > $@ for i in $(MIG_DEFS); do $(MIG) -user /dev/null -server /dev/null -header /dev/null -sheader /dev/null -flasksc `basename $$i .defs`.flask $$i; cat `basename $$i .defs`.flask >> $@; done $(mig_avs): $(mig_msgids) - cat $< | awk '{print $$1, $$2}' > $@ + cat $< | awk '{sub("^_*", "", $$1); print $$1, $$2}' > $@ $(mig_secclass): $(mig_avs) grep '^class' $< > $@ -sebsd_migscs: $(secclass) $(mig_msgids) - cat $(secclass) $(mig_msgids) | perl migscs.pl - .PHONY: install-src install-appconfig generate xml conf html bare tags .SUFFIXES: .SUFFIXES: .c ==== //depot/projects/trustedbsd/sedarwin8/policies/sedarwin/refpolicy/Rules.monolithic#4 (text+ko) ==== @@ -17,6 +17,7 @@ policy_conf = $(builddir)policy.conf fc = $(builddir)file_contexts polver = $(builddir)policy.$(pv) +migscs = $(builddir)sebsd_migscs homedir_template = $(builddir)homedir_template M4PARAM += -D self_contained_policy @@ -24,6 +25,7 @@ # install paths policypath = $(installdir)/policy loadpath = $(policypath)/$(notdir $(polver)) +migscs_loadpath = $(policypath)/sebsd_migscs homedirpath = $(contextpath)/files/homedir_template appfiles += $(installdir)/booleans $(userpath)/local.users @@ -51,14 +53,14 @@ # default: policy -policy: $(polver) +policy: $(polver) $(migscs) ifeq ($(SEDARWIN_BUILD),1) -install: install-src $(loadpath) $(fcpath) $(ncpath) $(appfiles) - ./update_plist --policy=$(loadpath) --migscs=sebsd_migscs --install-dir=/etc/sedarwin/$(strip $(NAME))/policy ../sedarwin/mac_sedarwin.kext/Contents/Info.plist && make -C ../sedarwin mac_sedarwin.kext.tar install +install: install-src $(loadpath) $(migscs_loadpath) $(fcpath) $(ncpath) $(appfiles) + ./update_plist --policy=$(loadpath) --migscs=$(migscs_loadpath) --install-dir=/etc/sedarwin/$(strip $(NAME))/policy ../sedarwin/mac_sedarwin.kext/Contents/Info.plist && make -C ../sedarwin mac_sedarwin.kext.tar install else -install: $(loadpath) $(fcpath) $(ncpath) $(appfiles) - ./update_plist --policy=$(loadpath) /System/Library/Extensions/mac_sedarwin.kext/Contents/Info.plist +install: $(loadpath) $(migscs_loadpath) $(fcpath) $(ncpath) $(appfiles) + ./update_plist --policy=$(loadpath) --migscs=$(migscs_loadpath) /System/Library/Extensions/mac_sedarwin.kext/Contents/Info.plist rm -f /System/Library/Extensions.kextcache /System/Library/Extensions.mkext endif @@ -82,6 +84,9 @@ endif $(verbose) $(CHECKPOLICY) -o $@ $^ +$(migscs): $(secclass) $(mig_msgids) + cat $(secclass) $(mig_msgids) | perl migscs.pl > $@ + ######################################## # # Install a binary policy @@ -94,15 +99,18 @@ @echo "WARNING: Policy version mismatch! Is your OUTPUT_POLICY set correctly?" @echo endif - $(verbose) $(CHECKPOLICY) -o $@ $^ + $(verbose) $(CHECKPOLICY) -o $@ $< + +$(migscs_loadpath): $(secclass) $(mig_msgids) + cat $(secclass) $(mig_msgids) | perl migscs.pl > $@ ######################################## # # Load the binary policy # -reload $(tmpdir)/load: $(loadpath) $(fcpath) $(ncpath) $(appfiles) - @echo "Loading $(NAME) $(loadpath)" - $(verbose) $(LOADPOLICY) -q $(loadpath) +reload $(tmpdir)/load: $(loadpath) $(migscs_loadpath) $(fcpath) $(ncpath) $(appfiles) + @echo "Loading $(NAME) $(shell sysctl -n security.mac.sebsd.policypath)" + $(verbose) $(LOADPOLICY) -q @touch $(tmpdir)/load ######################################## @@ -260,6 +268,10 @@ clean: rm -f $(policy_conf) rm -f $(polver) + rm -f $(migscs) + rm -f $(poldir)/mig_classes + rm -f $(poldir)/mig_access_vectors + rm -f $(poldir)/mig_msgids rm -f $(fc) rm -f $(homedir_template) rm -f $(net_contexts) ==== //depot/projects/trustedbsd/sedarwin8/policies/sedarwin/refpolicy/migscs.pl#2 (text+ko) ==== @@ -1,6 +1,5 @@ #!/usr/bin/perl -open (OUT, "> sebsd_migscs") || die ("cant open sebsd_migscs"); my %scs; my $curclass = 0; @@ -16,7 +15,7 @@ elsif (/^class/) { $curclass++; } } -print "$curclass classes\n"; +warn "$curclass classes\n"; my $out; foreach my $c (keys %scs) { @@ -25,6 +24,4 @@ foreach my $c (@ca) { $out .= pack ('I', $c); } } -print OUT $out; -close (OUT); - +print $out; ==== //depot/projects/trustedbsd/sedarwin8/policies/sedarwin/refpolicy/update_plist#4 (xtext) ==== @@ -25,7 +25,8 @@ $status = GetOptions("policy=s" => \$policy_file, "migscs=s" => \$migscs_file, "enforce!" => \$enforcing_mode, "install-dir=s" => \$install_dir); &usage() unless $status && $#ARGV == 0; -die "$0: install dir must be fully-qualified\n" unless $install_dir =~ /^\//; +die "$0: install dir must be fully-qualified\n" unless + !defined($install_dir) || $install_dir =~ /^\//; $plist_file = $ARGV[0]; my $data = Mac::PropertyList::parse_plist_file($plist_file) ||