Date: Sun, 7 Jul 2002 11:39:43 -0700 (PDT) From: Adam Migus <amigus@FreeBSD.org> To: Perforce Change Reviews <perforce@FreeBSD.org> Subject: PERFORCE change 13879 for review Message-ID: <200207071839.g67IdhCp008728@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
http://people.freebsd.org/~peter/p4db/chv.cgi?CH=13879 Change 13879 by amigus@amigus_vmganyopa on 2002/07/07 11:39:21 Integ Affected files ... .. //depot/projects/trustedbsd/mac/sys/ufs/ufs/ufs_vnops.c#38 edit .. //depot/user/amigus/amigus_mac_pipes/sys/boot/alpha/boot1/boot1.c#3 integrate .. //depot/user/amigus/amigus_mac_pipes/sys/boot/alpha/libalpha/common.h#2 integrate .. //depot/user/amigus/amigus_mac_pipes/sys/ddb/db_elf.c#2 integrate .. //depot/user/amigus/amigus_mac_pipes/sys/dev/sio/sio_ebus.c#2 integrate .. //depot/user/amigus/amigus_mac_pipes/sys/i386/isa/intr_machdep.h#2 integrate .. //depot/user/amigus/amigus_mac_pipes/sys/kern/kern_mac.c#12 integrate .. //depot/user/amigus/amigus_mac_pipes/sys/kern/vfs_subr.c#3 integrate .. //depot/user/amigus/amigus_mac_pipes/sys/kern/vfs_syscalls.c#6 integrate .. //depot/user/amigus/amigus_mac_pipes/sys/pci/if_ti.c#4 integrate .. //depot/user/amigus/amigus_mac_pipes/sys/security/mac_mls/mac_mls.c#9 integrate .. //depot/user/amigus/amigus_mac_pipes/sys/sparc64/conf/GENERIC#3 integrate .. //depot/user/amigus/amigus_mac_pipes/sys/sparc64/include/profile.h#2 integrate .. //depot/user/amigus/amigus_mac_pipes/sys/sparc64/sparc64/pmap.c#3 integrate .. //depot/user/amigus/amigus_mac_pipes_rewrite/sys/i386/conf/MAC#2 integrate .. //depot/user/amigus/amigus_mac_pipes_rewrite/sys/kern/kern_acl.c#2 integrate .. //depot/user/amigus/amigus_mac_pipes_rewrite/sys/kern/kern_mac.c#2 integrate .. //depot/user/amigus/amigus_mac_pipes_rewrite/sys/kern/sys_pipe.c#3 edit .. //depot/user/amigus/amigus_mac_pipes_rewrite/sys/kern/uipc_syscalls.c#2 integrate .. //depot/user/amigus/amigus_mac_pipes_rewrite/sys/kern/vfs_syscalls.c#2 integrate .. //depot/user/amigus/amigus_mac_pipes_rewrite/sys/security/mac_biba/mac_biba.c#2 integrate .. //depot/user/amigus/amigus_mac_pipes_rewrite/sys/security/mac_none/mac_none.c#2 integrate .. //depot/user/amigus/amigus_mac_pipes_rewrite/sys/security/mac_test/mac_test.c#2 integrate .. //depot/user/amigus/amigus_mac_pipes_rewrite/sys/sys/mac.h#2 integrate .. //depot/user/amigus/amigus_mac_pipes_rewrite/sys/sys/mac_policy.h#2 integrate .. //depot/user/amigus/amigus_mac_pipes_rewrite/sys/sys/pipe.h#3 integrate Differences ... ==== //depot/projects/trustedbsd/mac/sys/ufs/ufs/ufs_vnops.c#38 (text+ko) ==== @@ -84,6 +84,10 @@ #include <ufs/ufs/dirhash.h> #endif +#ifdef MALLOC_DECLARE +MALLOC_DECLARE(M_ACL); +#endif + static int ufs_access(struct vop_access_args *); static int ufs_advlock(struct vop_advlock_args *); static int ufs_chmod(struct vnode *, int, struct ucred *, struct thread *); ==== //depot/user/amigus/amigus_mac_pipes/sys/boot/alpha/boot1/boot1.c#3 (text+ko) ==== @@ -1,5 +1,5 @@ /* - * $FreeBSD: src/sys/boot/alpha/boot1/boot1.c,v 1.11 2002/06/11 10:19:59 phk Exp $ + * $FreeBSD: src/sys/boot/alpha/boot1/boot1.c,v 1.12 2002/06/29 02:32:32 peter Exp $ * From $NetBSD: bootxx.c,v 1.4 1997/09/06 14:08:29 drochner Exp $ */ @@ -253,7 +253,7 @@ char *name = "/boot/loader"; char *p; char filename[512]; - void (*entry) __P((void)); + void (*entry)(void); u_long start, freq; int i; ==== //depot/user/amigus/amigus_mac_pipes/sys/boot/alpha/libalpha/common.h#2 (text+ko) ==== @@ -1,11 +1,11 @@ /* - * $FreeBSD: src/sys/boot/alpha/libalpha/common.h,v 1.2 1999/08/28 00:39:26 peter Exp $ + * $FreeBSD: src/sys/boot/alpha/libalpha/common.h,v 1.3 2002/06/29 02:32:32 peter Exp $ * From: $NetBSD: common.h,v 1.2 1998/01/05 07:02:48 perry Exp $ */ -int prom_open __P((char*, int)); -void OSFpal __P((void)); -void halt __P((void)); -u_int64_t prom_dispatch __P((int, ...)); -int cpu_number __P((void)); -void switch_palcode __P((void)); +int prom_open(char*, int); +void OSFpal(void); +void halt(void); +u_int64_t prom_dispatch(int, ...); +int cpu_number(void); +void switch_palcode(void); ==== //depot/user/amigus/amigus_mac_pipes/sys/ddb/db_elf.c#2 (text+ko) ==== @@ -1,4 +1,4 @@ -/* $FreeBSD: src/sys/ddb/db_elf.c,v 1.10 2002/05/07 10:59:52 bde Exp $ */ +/* $FreeBSD: src/sys/ddb/db_elf.c,v 1.11 2002/06/29 02:32:33 peter Exp $ */ /* $NetBSD: db_elf.c,v 1.4 1998/05/03 18:49:54 thorpej Exp $ */ /*- @@ -56,7 +56,7 @@ #include <machine/elf.h> -static char *db_elf_find_strtab __P((db_symtab_t *)); +static char *db_elf_find_strtab(db_symtab_t *); #define STAB_TO_SYMSTART(stab) ((Elf_Sym *)((stab)->start)) #define STAB_TO_SYMEND(stab) ((Elf_Sym *)((stab)->end)) ==== //depot/user/amigus/amigus_mac_pipes/sys/dev/sio/sio_ebus.c#2 (text+ko) ==== @@ -24,7 +24,7 @@ */ #include <sys/cdefs.h> -__FBSDID($FreeBSD: src/sys/dev/sio/sio_ebus.c,v 1.1 2002/06/18 01:19:31 obrien Exp $); +__FBSDID($FreeBSD: src/sys/dev/sio/sio_ebus.c,v 1.2 2002/06/29 02:32:33 peter Exp $); #include <sys/param.h> #include <sys/systm.h> @@ -40,9 +40,9 @@ #include <ofw/openfirm.h> #include <sparc64/ebus/ebusvar.h> -int sio_ofw_inlist __P((char *name, char *list[])); -static int sio_ebus_attach __P((device_t dev)); -static int sio_ebus_probe __P((device_t dev)); +int sio_ofw_inlist(char *name, char *list[]); +static int sio_ebus_attach(device_t dev); +static int sio_ebus_probe(device_t dev); static device_method_t sio_ebus_methods[] = { /* Device interface */ ==== //depot/user/amigus/amigus_mac_pipes/sys/i386/isa/intr_machdep.h#2 (text+ko) ==== @@ -30,7 +30,7 @@ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF * SUCH DAMAGE. * - * $FreeBSD: src/sys/i386/isa/intr_machdep.h,v 1.40 2002/04/06 08:25:05 nyan Exp $ + * $FreeBSD: src/sys/i386/isa/intr_machdep.h,v 1.41 2002/06/29 02:32:33 peter Exp $ */ #ifndef _I386_ISA_INTR_MACHDEP_H_ @@ -140,7 +140,7 @@ * Type of the first (asm) part of an interrupt handler. */ typedef void inthand_t(u_int cs, u_int ef, u_int esp, u_int ss); -typedef void unpendhand_t __P((void)); +typedef void unpendhand_t(void); #define IDTVEC(name) __CONCAT(X,name) ==== //depot/user/amigus/amigus_mac_pipes/sys/kern/kern_mac.c#12 (text+ko) ==== @@ -988,6 +988,22 @@ ASSERT_VOP_LOCKED(vp, "vn_refreshlabel"); + if (vp->v_mount == NULL) { +/* + Eventually, we probably want to special-case refreshing + of deadfs vnodes, and if there's a lock-free race somewhere, + that case might be handled here. + + mac_update_vnode_deadfs(vp); + return (0); + */ + printf("vn_refreshlabel: null v_mount\n"); + if (vp->v_tag != VT_NON) + printf( + "vn_refreshlabel: null v_mount with non-VT_NON\n"); + return (EBADF); + } + if ((vp->v_mount->mnt_flag & MNT_MULTILABEL) == 0) { mac_update_vnode_from_mount(vp, vp->v_mount); return (0); @@ -2432,6 +2448,12 @@ { int error; + if (vp->v_mount == NULL) { + printf("vn_setlabel: null v_mount\n"); + if (vp->v_tag != VT_NON) + printf("vn_setlabel: null v_mount with non-VT_NON\n"); + return (EBADF); + } /* * Multi-phase commit. First check the policies to confirm the * change is OK. Then commit via the filesystem. Finally, ==== //depot/user/amigus/amigus_mac_pipes/sys/kern/vfs_subr.c#3 (text+ko) ==== @@ -36,7 +36,7 @@ * SUCH DAMAGE. * * @(#)vfs_subr.c 8.31 (Berkeley) 5/26/95 - * $FreeBSD: src/sys/kern/vfs_subr.c,v 1.365 2002/06/28 23:17:36 alfred Exp $ + * $FreeBSD: src/sys/kern/vfs_subr.c,v 1.366 2002/06/29 04:45:09 obrien Exp $ */ /* @@ -2465,7 +2465,7 @@ * List all of the locked vnodes in the system. * Called when debugging the kernel. */ -DB_SHOW_COMMAND(lockedvnodes, lockedvnodes) +DB_SHOW_COMMAND(lockedvnods, lockedvnodes) { struct thread *td = curthread; /* XXX */ struct mount *mp, *nmp; ==== //depot/user/amigus/amigus_mac_pipes/sys/kern/vfs_syscalls.c#6 (text+ko) ==== @@ -1977,7 +1977,7 @@ restart: bwillwrite(); - NDINIT(&nd, CREATE | SAVENAME, LOCKPARENT, UIO_USERSPACE, + NDINIT(&nd, CREATE, LOCKPARENT | SAVENAME, UIO_USERSPACE, SCARG(uap, path), td); if ((error = namei(&nd)) != 0) return (error); ==== //depot/user/amigus/amigus_mac_pipes/sys/pci/if_ti.c#4 (text+ko) ==== @@ -29,7 +29,7 @@ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF * THE POSSIBILITY OF SUCH DAMAGE. * - * $FreeBSD: src/sys/pci/if_ti.c,v 1.60 2002/06/26 03:34:52 ken Exp $ + * $FreeBSD: src/sys/pci/if_ti.c,v 1.61 2002/06/29 02:32:34 peter Exp $ */ /* @@ -152,7 +152,7 @@ #if !defined(lint) static const char rcsid[] = - "$FreeBSD: src/sys/pci/if_ti.c,v 1.60 2002/06/26 03:34:52 ken Exp $"; + "$FreeBSD: src/sys/pci/if_ti.c,v 1.61 2002/06/29 02:32:34 peter Exp $"; #endif struct ti_softc *tis[8]; @@ -270,8 +270,8 @@ static int ti_gibinit (struct ti_softc *); #ifdef TI_JUMBO_HDRSPLIT -static __inline void ti_hdr_split __P((struct mbuf *top, int hdr_len, - int pkt_len, int idx)); +static __inline void ti_hdr_split (struct mbuf *top, int hdr_len, + int pkt_len, int idx); #endif /* TI_JUMBO_HDRSPLIT */ static device_method_t ti_methods[] = { ==== //depot/user/amigus/amigus_mac_pipes/sys/security/mac_mls/mac_mls.c#9 (text+ko) ==== @@ -1118,6 +1118,9 @@ { struct mac_mls *subj, *obj; + if (!mac_mls_enabled) + return (0); + subj = SLOT(&cred->cr_label); obj = SLOT(socketlabel); ==== //depot/user/amigus/amigus_mac_pipes/sys/sparc64/conf/GENERIC#3 (text+ko) ==== @@ -19,7 +19,7 @@ # # For hardware specific information check HARDWARE.TXT # -# $FreeBSD: src/sys/sparc64/conf/GENERIC,v 1.22 2002/06/27 14:43:27 mux Exp $ +# $FreeBSD: src/sys/sparc64/conf/GENERIC,v 1.23 2002/06/29 04:42:03 obrien Exp $ machine sparc64 cpu SUN4U @@ -83,7 +83,9 @@ device atapicd # ATAPI CDROM drives #device atapifd # ATAPI floppy drives #device atapist # ATAPI tape drives -options ATA_STATIC_ID #Static device numbering +# Do NOT enable ATA_STATIC_ID -- cmd646 controller will be !ata2!, +# and you will not mount an ATA /. +#options ATA_STATIC_ID #Static device numbering # SCSI Controllers device ahc # AHA2940 and onboard AIC7xxx devices ==== //depot/user/amigus/amigus_mac_pipes/sys/sparc64/include/profile.h#2 (text+ko) ==== @@ -26,7 +26,7 @@ * * from: NetBSD: profile.h,v 1.9 1997/04/06 08:47:37 cgd Exp * from: FreeBSD: src/sys/alpha/include/profile.h,v 1.4 1999/12/29 - * $FreeBSD: src/sys/sparc64/include/profile.h,v 1.1 2001/11/18 17:56:46 jake Exp $ + * $FreeBSD: src/sys/sparc64/include/profile.h,v 1.2 2002/06/29 02:32:34 peter Exp $ */ #ifndef _MACHINE_PROFILE_H_ @@ -52,10 +52,10 @@ #ifdef GUPROF struct gmonparam; -void nullfunc_loop_profiled __P((void)); -void nullfunc_profiled __P((void)); -void startguprof __P((struct gmonparam *p)); -void stopguprof __P((struct gmonparam *p)); +void nullfunc_loop_profiled(void); +void nullfunc_profiled(void); +void startguprof(struct gmonparam *p); +void stopguprof(struct gmonparam *p); #else #define startguprof(p) #define stopguprof(p) ==== //depot/user/amigus/amigus_mac_pipes/sys/sparc64/sparc64/pmap.c#3 (text+ko) ==== @@ -39,7 +39,7 @@ * SUCH DAMAGE. * * from: @(#)pmap.c 7.7 (Berkeley) 5/12/91 - * $FreeBSD: src/sys/sparc64/sparc64/pmap.c,v 1.62 2002/06/25 15:13:07 jake Exp $ + * $FreeBSD: src/sys/sparc64/sparc64/pmap.c,v 1.63 2002/06/29 06:37:24 jake Exp $ */ /* @@ -1200,7 +1200,8 @@ KASSERT(pmap_resident_count(pm) == 0, ("pmap_release: resident pages %ld != 0", pmap_resident_count(pm))); - TAILQ_FOREACH(m, &obj->memq, listq) { + while (!TAILQ_EMPTY(&obj->memq)) { + m = TAILQ_FIRST(&obj->memq); if (vm_page_sleep_busy(m, FALSE, "pmaprl")) continue; vm_page_busy(m); ==== //depot/user/amigus/amigus_mac_pipes_rewrite/sys/i386/conf/MAC#2 (text+ko) ==== @@ -30,6 +30,7 @@ makeoptions DEBUG=-g #Build kernel with gdb(1) debug symbols options MAC +options UFS_ACL options UFS_EXTATTR options UFS_EXTATTR_AUTOSTART ==== //depot/user/amigus/amigus_mac_pipes_rewrite/sys/kern/kern_acl.c#2 (text+ko) ==== @@ -90,7 +90,7 @@ */ #ifndef CAPABILITIES if (suser_cred(cred, PRISON_ROOT) == 0) - cap_granted = (VEXEC | VREAD | VWRITE | VADMIN); + cap_granted = (VEXEC | VREAD | VWRITE | VADMIN | VAPPEND); else cap_granted = 0; #else @@ -110,9 +110,9 @@ PRISON_ROOT)) cap_granted |= VREAD; - if ((acc_mode & VWRITE) && !cap_check(cred, NULL, CAP_DAC_WRITE, - PRISON_ROOT)) - cap_granted |= VWRITE; + if (((acc_mode & VWRITE) || (acc_mode & VAPPEND)) && + !cap_check(cred, NULL, CAP_DAC_WRITE, PRISON_ROOT)) + cap_granted |= (VWRITE | VAPPEND); if ((acc_mode & VADMIN) && !cap_check(cred, NULL, CAP_FOWNER, PRISON_ROOT)) @@ -138,7 +138,7 @@ if (acl->acl_entry[i].ae_perm & ACL_READ) dac_granted |= VREAD; if (acl->acl_entry[i].ae_perm & ACL_WRITE) - dac_granted |= VWRITE; + dac_granted |= (VWRITE | VAPPEND); if ((acc_mode & dac_granted) == acc_mode) return (0); if ((acc_mode & (dac_granted | cap_granted)) == @@ -190,9 +190,9 @@ if (acl_mask->ae_perm & ACL_READ) acl_mask_granted |= VREAD; if (acl_mask->ae_perm & ACL_WRITE) - acl_mask_granted |= VWRITE; + acl_mask_granted |= (VWRITE | VAPPEND); } else - acl_mask_granted = VEXEC | VREAD | VWRITE; + acl_mask_granted = VEXEC | VREAD | VWRITE | VAPPEND; /* * Iterate through user ACL entries. Do checks twice, first @@ -214,7 +214,7 @@ if (acl->acl_entry[i].ae_perm & ACL_READ) dac_granted |= VREAD; if (acl->acl_entry[i].ae_perm & ACL_WRITE) - dac_granted |= VWRITE; + dac_granted |= (VWRITE | VAPPEND); dac_granted &= acl_mask_granted; if ((acc_mode & dac_granted) == acc_mode) return (0); @@ -247,7 +247,7 @@ if (acl->acl_entry[i].ae_perm & ACL_READ) dac_granted |= VREAD; if (acl->acl_entry[i].ae_perm & ACL_WRITE) - dac_granted |= VWRITE; + dac_granted |= (VWRITE | VAPPEND); dac_granted &= acl_mask_granted; if ((acc_mode & dac_granted) == acc_mode) @@ -265,7 +265,7 @@ if (acl->acl_entry[i].ae_perm & ACL_READ) dac_granted |= VREAD; if (acl->acl_entry[i].ae_perm & ACL_WRITE) - dac_granted |= VWRITE; + dac_granted |= (VWRITE | VAPPEND); dac_granted &= acl_mask_granted; if ((acc_mode & dac_granted) == acc_mode) @@ -295,7 +295,7 @@ if (acl->acl_entry[i].ae_perm & ACL_READ) dac_granted |= VREAD; if (acl->acl_entry[i].ae_perm & ACL_WRITE) - dac_granted |= VWRITE; + dac_granted |= (VWRITE | VAPPEND); dac_granted &= acl_mask_granted; if ((acc_mode & (dac_granted | cap_granted)) != @@ -316,7 +316,7 @@ if (acl->acl_entry[i].ae_perm & ACL_READ) dac_granted |= VREAD; if (acl->acl_entry[i].ae_perm & ACL_WRITE) - dac_granted |= VWRITE; + dac_granted |= (VWRITE | VAPPEND); dac_granted &= acl_mask_granted; if ((acc_mode & (dac_granted | cap_granted)) != @@ -347,7 +347,7 @@ if (acl_other->ae_perm & ACL_READ) dac_granted |= VREAD; if (acl_other->ae_perm & ACL_WRITE) - dac_granted |= VWRITE; + dac_granted |= (VWRITE | VAPPEND); if ((acc_mode & dac_granted) == acc_mode) return (0); ==== //depot/user/amigus/amigus_mac_pipes_rewrite/sys/kern/kern_mac.c#2 (text+ko) ==== @@ -222,6 +222,7 @@ } while (0) MALLOC_DEFINE(M_TMPLABEL, "tmplabel", "temporary user-label copied storage"); +MALLOC_DEFINE(M_MACPIPELABEL, "macpipelabel", "MAC labels for pipes"); const size_t maxlabelsize = 65536; /* @@ -456,6 +457,14 @@ mpc->mpc_ops.mpo_bpfdesc_check_receive_from_ifnet = mpe->mpe_function; break; + case MAC_CRED_CHECK_BIND_SOCKET: + mpc->mpc_ops.mpo_cred_check_bind_socket = + mpe->mpe_function; + break; + case MAC_CRED_CHECK_CONNECT_SOCKET: + mpc->mpc_ops.mpo_cred_check_connect_socket = + mpe->mpe_function; + break; case MAC_CRED_CHECK_SEE_CRED: mpc->mpc_ops.mpo_cred_check_see_cred = mpe->mpe_function; @@ -507,6 +516,10 @@ mpc->mpc_ops.mpo_cred_check_getextattr_vnode = mpe->mpe_function; break; + case MAC_CRED_CHECK_LISTEN_SOCKET: + mpc->mpc_ops.mpo_cred_check_listen_socket = + mpe->mpe_function; + break; case MAC_CRED_CHECK_OPEN_VNODE: mpc->mpc_ops.mpo_cred_check_open_vnode = mpe->mpe_function; @@ -1017,7 +1030,7 @@ { int error; - if (!mac_enforce_process) + if (!mac_enforce_process && !mac_enforce_fs) return (0); error = vn_refreshlabel(vp, cred); @@ -1215,9 +1228,13 @@ void mac_init_pipe(struct pipe *pipe) { + struct label *label; - mac_init_label(&pipe->pipe_label); - MAC_PERFORM(init_pipe, pipe, &pipe->pipe_label); + label = malloc(sizeof(struct label), M_MACPIPELABEL, M_ZERO|M_WAITOK); + mac_init_label(label); + pipe->pipe_label = label; + pipe->pipe_peer->pipe_label = label; + MAC_PERFORM(init_pipe, pipe, pipe->pipe_label); atomic_add_int(&nmacpipes, 1); } @@ -1225,8 +1242,9 @@ mac_destroy_pipe(struct pipe * pipe) { - MAC_PERFORM(destroy_pipe, pipe, &pipe->pipe_label); - mac_destroy_label(&pipe->pipe_label); + MAC_PERFORM(destroy_pipe, pipe, pipe->pipe_label); + mac_destroy_label(pipe->pipe_label); + free(pipe->pipe_label, M_MACPIPELABEL); atomic_subtract_int(&nmacpipes, 1); } @@ -1443,6 +1461,9 @@ ASSERT_VOP_LOCKED(dvp, "mac_cred_check_chdir_vnode"); + if (!mac_enforce_fs) + return (0); + error = vn_refreshlabel(dvp, cred); if (error) return (error); @@ -1459,6 +1480,9 @@ ASSERT_VOP_LOCKED(dvp, "mac_cred_check_create_vnode"); + if (!mac_enforce_fs) + return (0); + error = vn_refreshlabel(dvp, cred); if (error) return (error); @@ -1475,6 +1499,9 @@ ASSERT_VOP_LOCKED(vp, "mac_cred_check_getextattr_vnode"); + if (!mac_enforce_fs) + return (0); + error = vn_refreshlabel(vp, cred); if (error) return (error); @@ -1485,17 +1512,34 @@ } int +mac_cred_check_listen_socket(struct ucred *cred, struct socket *socket) +{ + int error; + + if (!mac_enforce_socket) + return (0); + + MAC_CHECK(cred_check_listen_socket, cred, socket, &socket->so_label); + return (error); +} + +int mac_cred_check_open_vnode(struct ucred *cred, struct vnode *vp, mode_t acc_mode) { int error; ASSERT_VOP_LOCKED(vp, "mac_cred_check_open_vnode"); + if (!mac_enforce_fs) + return (0); + error = vn_refreshlabel(vp, cred); if (error) return (error); MAC_CHECK(cred_check_open_vnode, cred, vp, &vp->v_label, acc_mode); + if (error) + printf("mac_cred_check_open_vnode returns %d\n", error); return (error); } @@ -1506,6 +1550,9 @@ ASSERT_VOP_LOCKED(vp, "mac_cred_check_revoke_vnode"); + if (!mac_enforce_fs) + return (0); + error = vn_refreshlabel(vp, cred); if (error) return (error); @@ -1521,6 +1568,9 @@ ASSERT_VOP_LOCKED(dvp, "mac_cred_check_search_vnode"); + if (!mac_enforce_fs) + return (0); + error = vn_refreshlabel(dvp, cred); if (error) return (error); @@ -1537,6 +1587,9 @@ ASSERT_VOP_LOCKED(vp, "mac_cred_check_setextattr_vnode"); + if (!mac_enforce_fs) + return (0); + error = vn_refreshlabel(vp, cred); if (error) return (error); @@ -1553,6 +1606,10 @@ int error; ASSERT_VOP_LOCKED(vp, "mac_cred_check_setflags_vnode"); + + if (!mac_enforce_fs) + return (0); + error = vn_refreshlabel(vp, cred); if (error) return (error); @@ -1569,6 +1626,9 @@ ASSERT_VOP_LOCKED(vp, "mac_cred_check_setmode_vnode"); + if (!mac_enforce_fs) + return (0); + error = vn_refreshlabel(vp, cred); if (error) return (error); @@ -1585,6 +1645,9 @@ ASSERT_VOP_LOCKED(vp, "mac_cred_check_setowner_vnode"); + if (!mac_enforce_fs) + return (0); + error = vn_refreshlabel(vp, cred); if (error) return (error); @@ -1601,6 +1664,9 @@ ASSERT_VOP_LOCKED(vp, "mac_cred_check_setutimes_vnode"); + if (!mac_enforce_fs) + return (0); + error = vn_refreshlabel(vp, cred); if (error) return (error); @@ -1619,6 +1685,9 @@ ASSERT_VOP_LOCKED(dvp, "mac_cred_check_delete_vnode"); ASSERT_VOP_LOCKED(vp, "mac_cred_check_delete_vnode"); + if (!mac_enforce_fs) + return (0); + error = vn_refreshlabel(dvp, cred); if (error) return (error); @@ -1640,6 +1709,9 @@ ASSERT_VOP_LOCKED(dvp, "mac_cred_check_rename_from_vnode"); ASSERT_VOP_LOCKED(vp, "mac_cred_check_rename_from_vnode"); + if (!mac_enforce_fs) + return (0); + error = vn_refreshlabel(dvp, cred); if (error) return (error); @@ -1661,6 +1733,9 @@ ASSERT_VOP_LOCKED(dvp, "mac_cred_check_rename_to_vnode"); ASSERT_VOP_LOCKED(vp, "mac_cred_check_rename_to_vnode"); + if (!mac_enforce_fs) + return (0); + error = vn_refreshlabel(dvp, cred); if (error) return (error); @@ -1681,6 +1756,9 @@ ASSERT_VOP_LOCKED(vp, "mac_cred_check_stat_vnode"); + if (!mac_enforce_fs) + return (0); + error = vn_refreshlabel(vp, cred); if (error) return (error); @@ -1728,7 +1806,7 @@ mac_create_pipe(struct ucred *cred, struct pipe *pipe) { - MAC_PERFORM(create_pipe, cred, pipe, &pipe->pipe_label); + MAC_PERFORM(create_pipe, cred, pipe, pipe->pipe_label); } void @@ -1884,7 +1962,7 @@ { int error; - MAC_CHECK(cred_check_pipe_op, cred, pipe, &pipe->pipe_label, op); + MAC_CHECK(cred_check_pipe_op, cred, pipe, pipe->pipe_label, op); return (error); } @@ -1895,7 +1973,7 @@ { int error; - MAC_CHECK(cred_check_pipe_ioctl, cred, pipe, &pipe->pipe_label, + MAC_CHECK(cred_check_pipe_ioctl, cred, pipe, pipe->pipe_label, cmd, data); return (error); @@ -1951,6 +2029,36 @@ } int +mac_cred_check_bind_socket(struct ucred *ucred, struct socket *socket, + struct sockaddr *sockaddr) +{ + int error; + + if (!mac_enforce_socket) + return (0); + + MAC_CHECK(cred_check_bind_socket, ucred, socket, &socket->so_label, + sockaddr); + + return (error); +} + +int +mac_cred_check_connect_socket(struct ucred *cred, struct socket *socket, + struct sockaddr *sockaddr) +{ + int error; + + if (!mac_enforce_socket) + return (0); + + MAC_CHECK(cred_check_connect_socket, cred, socket, &socket->so_label, + sockaddr); + + return (error); +} + +int mac_socket_can_receive(struct socket *socket, struct mbuf *mbuf) { int error; ==== //depot/user/amigus/amigus_mac_pipes_rewrite/sys/kern/sys_pipe.c#3 (text+ko) ==== @@ -1376,6 +1376,13 @@ cpipe->pipe_state |= PIPE_WANT | PIPE_EOF; msleep(cpipe, PIPE_MTX(cpipe), PRIBIO, "pipecl", 0); } +#ifdef MAC + /* + * Destroy MAC data + */ + if (cpipe->pipe_peer) + mac_destroy_pipe(cpipe); +#endif /* MAC */ KNOTE(&cpipe->pipe_sel.si_note, 0); ==== //depot/user/amigus/amigus_mac_pipes_rewrite/sys/kern/uipc_syscalls.c#2 (text+ko) ==== @@ -39,6 +39,7 @@ #include "opt_compat.h" #include "opt_ktrace.h" +#include "opt_mac.h" #include <sys/param.h> #include <sys/systm.h> @@ -178,6 +179,13 @@ goto done2; if ((error = getsockaddr(&sa, uap->name, uap->namelen)) != 0) goto done1; +#ifdef MAC + error = mac_cred_check_bind_socket(td->td_ucred, so, sa); + if (error) { + FREE(sa, M_SONAME); + goto done1; + } +#endif error = sobind(so, sa, td); FREE(sa, M_SONAME); done1: @@ -204,7 +212,15 @@ mtx_lock(&Giant); if ((error = fgetsock(td, uap->s, &so, NULL)) == 0) { +#ifdef MAC + error = mac_cred_check_listen_socket(td->td_ucred, so); + if (error) + goto done; +#endif error = solisten(so, uap->backlog, td); +#ifdef MAC +done: +#endif fputsock(so); } mtx_unlock(&Giant); @@ -439,6 +455,11 @@ error = getsockaddr(&sa, uap->name, uap->namelen); if (error) goto done1; +#ifdef MAC + error = mac_cred_check_connect_socket(td->td_ucred, so, sa); + if (error) + goto bad; +#endif error = soconnect(so, sa, td); if (error) goto bad; ==== //depot/user/amigus/amigus_mac_pipes_rewrite/sys/kern/vfs_syscalls.c#2 (text+ko) ==== @@ -1655,6 +1655,9 @@ return (error); NDINIT(&nd, LOOKUP, FOLLOW | LOCKLEAF, UIO_USERSPACE, SCARG(uap, path), td); +#ifdef MAC + /* XXXMAC: MAC check for chroot here. */ +#endif if ((error = change_dir(&nd, td)) != 0) return (error); NDFREE(&nd, NDF_ONLY_PNBUF); @@ -2232,6 +2235,11 @@ return (error); goto restart; } +#ifdef MAC + /* + * XXXMAC: Need some or another MAC check here. + */ +#endif VOP_LEASE(nd.ni_dvp, td, td->td_ucred, LEASE_WRITE); error = VOP_WHITEOUT(nd.ni_dvp, &nd.ni_cnd, DELETE); NDFREE(&nd, NDF_ONLY_PNBUF); @@ -2873,6 +2881,11 @@ return (error); NDFREE(&nd, NDF_ONLY_PNBUF); vp = nd.ni_vp; +#ifdef MAC + /* + * XXXMAC: need some or another MAC check here. + */ +#endif if (vp->v_type != VLNK) error = EINVAL; else { ==== //depot/user/amigus/amigus_mac_pipes_rewrite/sys/security/mac_biba/mac_biba.c#2 (text+ko) ==== @@ -1680,7 +1680,7 @@ return (0); subj = SLOT(&cred->cr_label); - obj = SLOT(&pipe->pipe_label); + obj = SLOT((pipelabel)); switch(op) { case MAC_OP_PIPE_READ: ==== //depot/user/amigus/amigus_mac_pipes_rewrite/sys/security/mac_none/mac_none.c#2 (text+ko) ==== @@ -525,6 +525,22 @@ } static int +mac_none_cred_check_bind_socket(struct ucred *cred, struct socket *socket, + struct label *socketlabel, struct sockaddr *sockaddr) +{ + + return (0); +} + +static int +mac_none_cred_check_connect_socket(struct ucred *cred, struct socket *socket, + struct label *socketlabel, struct sockaddr *sockaddr) +{ + + return (0); +} + +static int mac_none_cred_check_see_cred(struct ucred *u1, struct ucred *u2) { @@ -626,6 +642,14 @@ } static int +mac_none_cred_check_listen_socket(struct ucred *cred, struct vnode *vp, + struct label *socketlabel) +{ + + return (0); +} + +static int mac_none_cred_check_open_vnode(struct ucred *cred, struct vnode *vp, struct label *filelabel, mode_t acc_mode) { @@ -872,6 +896,10 @@ (macop_t)mac_none_relabel_subject }, { MAC_BPFDESC_CHECK_RECEIVE_FROM_IFNET, (macop_t)mac_none_bpfdesc_check_receive_from_ifnet }, + { MAC_CRED_CHECK_BIND_SOCKET, + (macop_t)mac_none_cred_check_bind_socket }, + { MAC_CRED_CHECK_CONNECT_SOCKET, + (macop_t)mac_none_cred_check_connect_socket }, { MAC_CRED_CHECK_SEE_CRED, (macop_t)mac_none_cred_check_see_cred }, { MAC_CRED_CHECK_SEE_SOCKET, @@ -898,6 +926,8 @@ (macop_t)mac_none_cred_check_exec_vnode }, { MAC_CRED_CHECK_GETEXTATTR_VNODE, (macop_t)mac_none_cred_check_getextattr_vnode }, + { MAC_CRED_CHECK_LISTEN_SOCKET, + (macop_t)mac_none_cred_check_listen_socket }, { MAC_CRED_CHECK_OPEN_VNODE, (macop_t)mac_none_cred_check_open_vnode }, { MAC_CRED_CHECK_RENAME_FROM_VNODE, ==== //depot/user/amigus/amigus_mac_pipes_rewrite/sys/security/mac_test/mac_test.c#2 (text+ko) ==== @@ -753,6 +753,22 @@ } static int +mac_test_cred_check_bind_socket(struct ucred *cred, struct socket *socket, + struct label *socketlabel, struct sockaddr *sockaddr) +{ + + return (0); +} + +static int +mac_test_cred_check_connect_socket(struct ucred *cred, struct socket *socket, + struct label *socketlabel, struct sockaddr *sockaddr) +{ + + return (0); +} + +static int mac_test_cred_check_see_cred(struct ucred *u1, struct ucred *u2) { @@ -870,6 +886,14 @@ } static int +mac_test_cred_check_listen_socket(struct ucred *cred, struct socket *socket, + struct label *socketlabel, struct sockaddr *sockaddr) +{ + + return (0); +} + +static int mac_test_cred_check_open_vnode(struct ucred *cred, struct vnode *vp, struct label *filelabel, mode_t acc_mode) { @@ -1120,6 +1144,10 @@ (macop_t)mac_test_relabel_subject }, { MAC_BPFDESC_CHECK_RECEIVE_FROM_IFNET, (macop_t)mac_test_bpfdesc_check_receive_from_ifnet }, + { MAC_CRED_CHECK_BIND_SOCKET, + (macop_t)mac_test_cred_check_bind_socket }, + { MAC_CRED_CHECK_CONNECT_SOCKET, + (macop_t)mac_test_cred_check_connect_socket }, { MAC_CRED_CHECK_SEE_CRED, (macop_t)mac_test_cred_check_see_cred }, { MAC_CRED_CHECK_SEE_SOCKET, @@ -1146,6 +1174,8 @@ >>> TRUNCATED FOR MAIL (1000 lines) <<< To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe p4-projects" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200207071839.g67IdhCp008728>