From owner-p4-projects Thu Jul 25 15:27:53 2002 Delivered-To: p4-projects@freebsd.org Received: by hub.freebsd.org (Postfix, from userid 32767) id 8193037B401; Thu, 25 Jul 2002 15:26:40 -0700 (PDT) Delivered-To: perforce@freebsd.org Received: from mx1.FreeBSD.org (mx1.FreeBSD.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 0A94537B400 for ; Thu, 25 Jul 2002 15:26:40 -0700 (PDT) Received: from freefall.freebsd.org (freefall.FreeBSD.org [216.136.204.21]) by mx1.FreeBSD.org (Postfix) with ESMTP id BAE5143E4A for ; Thu, 25 Jul 2002 15:26:38 -0700 (PDT) (envelope-from chris@freebsd.org) Received: from freefall.freebsd.org (perforce@localhost [127.0.0.1]) by freefall.freebsd.org (8.12.4/8.12.4) with ESMTP id g6PMQcJU049981 for ; Thu, 25 Jul 2002 15:26:38 -0700 (PDT) (envelope-from chris@freebsd.org) Received: (from perforce@localhost) by freefall.freebsd.org (8.12.4/8.12.4/Submit) id g6PMQcYk049978 for perforce@freebsd.org; Thu, 25 Jul 2002 15:26:38 -0700 (PDT) Date: Thu, 25 Jul 2002 15:26:38 -0700 (PDT) Message-Id: <200207252226.g6PMQcYk049978@freefall.freebsd.org> X-Authentication-Warning: freefall.freebsd.org: perforce set sender to chris@freebsd.org using -f From: Chris Costello Subject: PERFORCE change 14920 for review To: Perforce Change Reviews Sender: owner-p4-projects@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG http://people.freebsd.org/~peter/p4db/chv.cgi?CH=14920 Change 14920 by chris@chris_holly on 2002/07/25 15:26:22 o Process labeling event ops o Access control checks That's "all" of the entry points, so far! Affected files ... .. //depot/projects/trustedbsd/doc/en_US.ISO8859-1/books/developers-handbook/mac/chapter.sgml#8 edit Differences ... ==== //depot/projects/trustedbsd/doc/en_US.ISO8859-1/books/developers-handbook/mac/chapter.sgml#8 (text+ko) ==== @@ -2865,20 +2865,651 @@ + + Process Labeling Event Operations + + ... + + + <function>&mac.mpo;_create_subject</function> + + + + void + &mac.mpo;_create_subject + + struct ucred + *parent_cred + struct ucred + *child_cred + + + + + + &mac.thead; + + + + parent_cred + Parent subject credential + + + + child_cred + Child subject credential + + + + + + + Set the label of a newly created subject credential from + the passed subject credential. This call will be made when + crcopy(9) is invoked on a newly created struct + ucred. This call should not be confused with a + process forking or creation event. + + + + <function>&mac.mpo;_execve_transition</function> + + + + void + &mac.mpo;_execve_transition + + struct ucred + *old + struct ucred + *new + struct vnode + *vp + struct label + *vnodelabel + + + + + + &mac.thead; + + + + old + Existing subject credential + Immutable + + + + new + New subject credential to be labeled + + + + vp + File to execute + Locked + + + + vnodelabel + Policy label for + vp + + + + + + Update the label of a newly created subject credential + (new) from the passed existing + subject credential (old) based on a + label transition caused by executing the passed vnode + (vp). This call occurs when a + process executes the passed vnode and one of the policies + returns a success from the + mpo_execve_will_transition entry point. + Policies may choose to implement this call simply by + invoking mpo_create_subject and passing + the two subject credentials so as not to implement a + transitioning event. Policies should not leave this entry + point unimplemented if they implement + mpo_create_subject, even if they do not + implement + mpo_execve_will_transition. + + + + <function>&mac.mpo;_execve_will_transition</function> + + + + int + &mac.mpo;_execve_will_transition + + struct ucred + *old + struct vnode + *vp + struct label + *vnodelabel + + + + + + &mac.thead; + + + + old + Subject credential prior to + &man.execve.2; + Immutable + + + + vp + File to execute + + + + vnodelabel + Policy label for + vp + + + + + + Determine whether the policy will want to perform a + transition event as a result of the execution of the passed + vnode by the passed subject credential. Return + 1 if a transition is required, + 0 if not. Even if a policy + returns 0, it should behave + correctly in the presence of an unexpected invocation of + mpo_execve_transition, as that call may + happen as a result of another policy requesting a + transition. + + + + <function>&mac.mpo;_create_proc0</function> + + + + void + &mac.mpo;_create_proc0 + + struct ucred + *cred + + + + + + &mac.thead; + + + + cred + Subject credential to be filled in + + + + + + Create the subject credential of process 0, the parent + of all kernel processes. + + + + <function>&mac.mpo;_create_proc1</function> + + + + void + &mac.mpo;_create_proc1 + + struct ucred + *cred + + + + + + &mac.thead; + + + + cred + Subject credential to be filled in + + + + + + Create the subject credential of process 1, the parent + of all kernel processes. + + + + <function>&mac.mpo;_relabel_subject</function> + + + + void + &mac.mpo;_relabel_subject + + struct ucred + *cred + struct label + *newlabel + + + + + + &mac.thead; + + + + cred + Subject credential + + + + newlabel + Label update to apply to + cred + + + + + + Update the label on a subject credential from the passed + update label. + + + Access Control Checks Access control checks are implemented as checks supplementary to existing Unix permissions. + + <function>&mac.mpo;_bpfdesc_check_receive_from_ifnet</function> + + + + int + &mac.mpo;_bpfdesc_check_receive_from_ifnet + + struct bpf_d + *bpf_d + struct label + *bpflabel + struct ifnet + *ifnet + struct label + *ifnetlabel + + + + + + &mac.thead; + + + + bpf_d + Subject; BPF descriptor + + + + bpflabel + Policy label for + bpf_d + + + + ifnet + Object; network interface + + + + ifnetlabel + Policy label for + ifnet + + + + + + Determine whether the MAC framework should permit + datagrams from the passed interface to be delivered to the + buffers of the passed BPF descriptor. Return + (0) for success, or an + errno value for failure Suggested + failure: EACCES for label mismatches, + EPERM for lack of privilege. + + + + <function>&mac.mpo;_cred_check_bind_socket</function> + + + + int + &mac.mpo;_cred_check_bind_socket + + struct ucred + *cred + struct socket + *socket + struct label + *socketlabel + struct sockaddr + *sockaddr + + + + + + &mac.thead; + + + + cred + Subject credential + + + + socket + Socket to be bound + + + + socketlabel + Policy label for + socket + + + + sockaddr + Address of + socket + + + + + + + + + <function>&mac.mpo;_cred_check_connect_socket</function> + + + + int + &mac.mpo;_cred_check_connect_socket + + struct ucred + *cred + struct socket + *socket + struct label + *socketlabel + struct sockaddr + *sockaddr + + + + + + &mac.thead; + + + + cred + Subject credential + + + + socket + Socket to be connected + + + + socketlabel + Policy label for + socket + + + + sockaddr + Address of + socket + + + + + + Determine whether the subject credential + (cred) can connect the passed socket + (socket) to the passed socket address + (sockaddr). Return + 0 for success, or an + errno value for failure. Suggested + failure: EACCES for label mismatches, + EPERM for lack of privilege. + + + + <function>&mac.mpo;_cred_check_see_cred</function> + + + + int + &mac.mpo;_cred_check_see_cred + + struct ucred + *u1 + struct ucred + *u2 + + + + + + &mac.thead; + + + + u1 + Subject credential + + + + u2 + Object credential + + + + + + Determine whether the subject credential + u1 can see other + subjects with the passed subject credential + u2. Return + 0 for success, or an + errno value for failure. Suggested + failure: EACCES for label mismatches, + EPERM for lack of privilege, or + ESRCH to hide visibility. This call + may be made in a number of situations, including + inter-process status sysctls used by ps, + and in procfs lookups. + + + + <function>&mac.mpo;_cred_check_see_socket</function> + + + + int + &mac.mpo;_cred_check_see_socket + + struct ucred + *cred + struct socket + *socket + struct label + *socketlabel + + + + + + &mac.thead; + + + + cred + Subject credential + + + + socket + Object; socket + + + + socketlabel + Policy label for + socket + + + + + + + + + <function>&mac.mpo;_cred_check_relabel_ifnet</function> + + + + int + &mac.mpo;_cred_check_relabel_ifnet + + struct ucred + *cred + struct ifnet + *ifnet + struct label + *ifnetlabel + struct label + *newlabel + + + + + + &mac.thead; + + + + cred + Subject credential + + + + ifnet + Object; network interface + + + + ifnetlabel + Existing policy label for + ifnet + + + + newlabel + Policy label update to later be applied to + ifnet + + + + + + Determine whether the subject credential can relabel the + passed network interface to the passed label update. + + + + <function>&mac.mpo;_cred_check_relabel_socket</function> + + + + int + &mac.mpo;_cred_check_relabel_socket + + struct ucred + *cred + struct socket + *socket + struct label + *socketlabel + struct label + *newlabel + + + + + + &mac.thead; + + + + cred + Subject credential + + + + socket + Object; socket + + + + socketlabel + Existing policy label for + socket + + + + newlabel + Label update to later be applied to + socketlabel + + + + + + Determine whether the subject credential can relabel the + passed socket to the passed label update. + + <function>&mac.mpo;_cred_check_relabel_subject</function> int - &mac.mpo;_cred_check_relabel_subject - + &mac.mpo;_cred_check_relabel_subject struct ucred *cred @@ -2890,50 +3521,101 @@ &mac.thead; + + + + cred + Subject credential + + + newlabel + Label update to later be applied to + cred + + + + + + Determine whether the subject credential can relabel + itself to the passed label update. + + + + <function>&mac.mpo;_cred_check_relabel_vnode</function> + + + + int + &mac.mpo;_cred_check_relabel_vnode + + struct ucred + *cred + struct vnode + *vp + struct label + *vnodelabel + struct label + *newlabel + + + + + + &mac.thead; + cred Subject credential + Immutable - newlabel - New label to apply to subject + vp + Object; vnode + Locked + + + + vnodelabel + Existing policy label for + vp + + + + newlabel + Policy label update to later be applied to + vp + - This policy operation is intended to determine whether a - subject should be allowed to change its label. Generally, - this is implemented by checking if the subject would be - upgrading its own privilege by making the requested change, - and denying (returning typically - EPERM) the request if so. + Determine whether the subject credential can relabel the + passed vnode to the passed label update. - - <function>&mac.mpo;_cred_check_statfs</function + + <function>&mac.mpo;_cred_check_statfs</function> - int - &mac.mpo;_cred_check_statfs - + int &mac.mpo;_cred_check_statfs struct ucred *cred struct mount *mp struct label - *mntlabel + *mountlabel &mac.thead; - + cred @@ -2942,29 +3624,28 @@ mp - Object; file system mount point + Object; file system mount - mntlabel - Object label + mountlabel + Policy label for + mp + - This policy operation is intended to determine whether a - specified subject should be allowed to retrieve file system - statistics information. Generally a policy module - implementing this operation would compare the subject label - (cred->cr_label) to the object label - (mntlabel) and return - 0 if the subject is to be granted the - information requested, and EACCES - otherwise. - - Figure out a scenario where using - mp is immenently practical, especially - for use in the sample module. + Determine whether the subject credential can see the + results of a statfs performed on the file system. Return + 0 for success, or an + errno value for failure. Suggested + failure: EACCES for label mismatches + or EPERM for lack of privilege. This + call may be made in a number of situations, including during + invocations of &man.statfs.2; and related calls, as well as to + determine what file systems to exclude from listings of file + systems, such as when &man.getfsstat.2; is invoked. @@ -2973,11 +3654,1390 @@ int - &mac.mpo;_cred_check_debug_proc - + &mac.mpo;_cred_check_debug_proc + + struct ucred + *cred + struct proc + *proc + + + + + + &mac.thead; + + + + cred + Subject credential + Immutable + + + + proc + Object; process + + + + + + Determine whether the subject credential can debug the + passed process. Return 0 for + success, or an errno value for failure. + Suggested failure: EACCES for label + mismatch, EPERM for lack of + privilege, or ESRCH to hide + visibility of the target. This call may be made in a number + of situations, including use of the &man.ptrace.2; and + &man.ktrace.2; APIs, as well as for some types of procfs + operations. + + + + <function>&mac.mpo;_cred_check_access_vnode</function> + + + + int + &mac.mpo;_cred_check_access_vnode + + struct ucred + *cred + struct vnode + *vp + struct label + *label + int flags + + + + + + &mac.thead; + + + + cred + Subject credential + + + + vp + Object; vnode + + + + label + Policy label for + vp + + + + flags + &man.access.2; flags + + + + + + Determine how invocations of &man.access.2; and related + calls by the subject credential should return when performed + on the passed vnode using the passed access flags. Return + 0 for success, or an + errno value for failure. Suggested + failure: EACCES for label mismatches + or EPERM for lack of + privilege. + + + + <function>&mac.mpo;_cred_check_chdir_vnode</function> + + + + int + &mac.mpo;_cred_check_chdir_vnode + + struct ucred + *cred + struct vnode + *dvp + struct label + *dlabel + + + + + + &mac.thead; + + + + cred + Subject credential + + + + dvp + Object; vnode to &man.chdir.2; into + + + + dlabel + Policy label for + dvp + + + + + + Determine whether the subject credential can change the + process working directory to the passed vnode. Return + 0 for success, or an + errno value for failure. Suggested + failure: EACCES for label mismatch, + or EPERM for lack of + privilege. + + + + <function>&mac.mpo;_cred_check_create_vnode</function> + + + + int + &mac.mpo;_cred_check_create_vnode + + struct ucred + *cred + struct vnode + *dvp + struct label + *dlabel + struct componentname + *cnp >>> TRUNCATED FOR MAIL (1000 lines) <<< To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe p4-projects" in the body of the message