From owner-p4-projects Wed Aug 7 13:53:32 2002 Delivered-To: p4-projects@freebsd.org Received: by hub.freebsd.org (Postfix, from userid 32767) id 3F0F437B401; Wed, 7 Aug 2002 13:53:17 -0700 (PDT) Delivered-To: perforce@freebsd.org Received: from mx1.FreeBSD.org (mx1.FreeBSD.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id B434E37B400 for ; Wed, 7 Aug 2002 13:53:16 -0700 (PDT) Received: from freefall.freebsd.org (freefall.FreeBSD.org [216.136.204.21]) by mx1.FreeBSD.org (Postfix) with ESMTP id 51F9B43E70 for ; Wed, 7 Aug 2002 13:53:16 -0700 (PDT) (envelope-from chris@freebsd.org) Received: from freefall.freebsd.org (perforce@localhost [127.0.0.1]) by freefall.freebsd.org (8.12.4/8.12.4) with ESMTP id g77KrGJU066919 for ; Wed, 7 Aug 2002 13:53:16 -0700 (PDT) (envelope-from chris@freebsd.org) Received: (from perforce@localhost) by freefall.freebsd.org (8.12.4/8.12.4/Submit) id g77KrFoJ066916 for perforce@freebsd.org; Wed, 7 Aug 2002 13:53:15 -0700 (PDT) Date: Wed, 7 Aug 2002 13:53:15 -0700 (PDT) Message-Id: <200208072053.g77KrFoJ066916@freefall.freebsd.org> X-Authentication-Warning: freefall.freebsd.org: perforce set sender to chris@freebsd.org using -f From: Chris Costello Subject: PERFORCE change 15659 for review To: Perforce Change Reviews Sender: owner-p4-projects@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG http://people.freebsd.org/~peter/p4db/chv.cgi?CH=15659 Change 15659 by chris@chris_holly on 2002/08/07 13:52:26 o Clarify create_root_mount vs. create_mount o Minor spelling and markup fixes o Fix one entry point missed in the action_object -> object_action thing o Note that the access(2) checks should be the same as in mpo_check_open. o Make note of race conditions involved in dealing with UIO_USERSPACE uio, and that the `uio' parameter to mpo_check_setextattr might be NULL. o Add some man page references. o `_' is an illegal character for section ids. o Add mpo_check_socket_visible. Affected files ... .. //depot/projects/trustedbsd/doc/en_US.ISO8859-1/books/developers-handbook/mac/chapter.sgml#12 edit Differences ... ==== //depot/projects/trustedbsd/doc/en_US.ISO8859-1/books/developers-handbook/mac/chapter.sgml#12 (text+ko) ==== @@ -1336,8 +1336,7 @@ Fill out the labels on the mount point being created by the passed subject credential. This call will be made when - a new file system is mounted, other than the root file - system. + a new file system is mounted. @@ -1374,7 +1373,8 @@ Fill out the labels on the mount point being created by the passed subject credential. This call will be made when - the root file system is mounted. + the root file system is mounted, after + &mac.mpo;_create_mount;. @@ -1906,7 +1906,7 @@ newsocket - Object; phild socket; incoming connection + Object; child socket; incoming connection @@ -3248,13 +3248,14 @@ - - <function>&mac.mpo;_check_connect_socket</function> + + + <function>&mac.mpo;_check_socket_connect</function> int - &mac.mpo;_check_connect_socket + &mac.mpo;_check_socket_connect struct ucred *cred @@ -3744,8 +3745,10 @@ Determine how invocations of &man.access.2; and related calls by the subject credential should return when performed - on the passed vnode using the passed access flags. Return - 0 for success, or an + on the passed vnode using the passed access flags. This + should generally be implemented using the same semantics + used in &mac.mpo;_check_vnode_open. + Return 0 for success, or an errno value for failure. Suggested failure: EACCES for label mismatches or EPERM for lack of @@ -4649,7 +4652,7 @@ Determine whether the subject credential can revoke access to the passed vnode. Return 0 for success, or an - errno value for failure. Suggested + errno value for failure. Suggested failure: EACCES for label mismatch, or EPERM for lack of privilege. @@ -4784,9 +4787,14 @@ extended attribute of passed name and passed namespace on the passed vnode. Policies implementing security labels backed into extended attributes may want to provide - additional protections for those attributes. Return - 0 for success, or an - errno value for failure. Suggested + additional protections for those attributes. Additionally, + policies should avoid making decisions based on the data + referenced from uio, as there is a + potential race condition between this check and the actual + operation. The uio may also be + NULL if a delete operation is being + performed. Return 0 for success, + or an errno value for failure. Suggested failure: EACCES for label mismatch, or EPERM for lack of privilege. @@ -5009,12 +5017,12 @@ atime - Access time + Access time; see &man.utimes.2; mtime - Modification time + Modification time; see &man.utimes.2; @@ -5069,9 +5077,11 @@ failure: EACCES for label mismatch, EPERM for lack of privilege, or ESRCH to limit visibility. + + See &man.setpriority.2; for more information. - + <function>&mac.mpo;_check_proc_signal</function> @@ -5104,7 +5114,7 @@ signal - Signal; see &man.sigaction.2; + Signal; see &man.kill.2; @@ -5163,10 +5173,12 @@ Determine whether the subject credential can stat the passed vnode. Return 0 for success, or an - errno value for failure. Suggested + errno value for failure. Suggested failure: EACCES for label mismatch, or EPERM for lack of privilege. + + See &man.stat.2; for more information. @@ -5297,6 +5309,59 @@ or EPERM for lack of privilege. + + + <function>&mac.mpo;_check_socket_visible</function> + + + + int + &mac.mpo;_check_socket_visible + + struct ucred + *cred + struct socket + *so + struct label + *socketlabel + + + + + + &mac.thead; + + + + cred + Subject credential + Immutable + + + + so + Object; socket + + + + socketlabel + Policy label for + so + + + + + + Determine whether the subject credential cred can "see" + the passed socket (socket) using + system monitoring functions, such as those employed by + &man.netstat.8; and &man.sockstat.1;. Return + 0 for success, or an + errno value for failure. Suggested + failure: EACCES for label mismatches, + EPERM for lack of privilege, or + ESRCH to hide visibility. + To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe p4-projects" in the body of the message