From owner-p4-projects  Sun Sep 22 10:23:17 2002
Delivered-To: p4-projects@freebsd.org
Received: by hub.freebsd.org (Postfix, from userid 32767)
	id 836B937B404; Sun, 22 Sep 2002 10:23:15 -0700 (PDT)
Delivered-To: perforce@freebsd.org
Received: from mx1.FreeBSD.org (mx1.FreeBSD.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 2C02E37B401
	for <perforce@freebsd.org>; Sun, 22 Sep 2002 10:23:15 -0700 (PDT)
Received: from freefall.freebsd.org (freefall.FreeBSD.org [216.136.204.21])
	by mx1.FreeBSD.org (Postfix) with ESMTP id DA7C743E75
	for <perforce@freebsd.org>; Sun, 22 Sep 2002 10:23:14 -0700 (PDT)
	(envelope-from bb+lists.freebsd.perforce@cyrus.watson.org)
Received: from freefall.freebsd.org (perforce@localhost [127.0.0.1])
	by freefall.freebsd.org (8.12.6/8.12.6) with ESMTP id g8MHNECo003305
	for <perforce@freebsd.org>; Sun, 22 Sep 2002 10:23:14 -0700 (PDT)
	(envelope-from bb+lists.freebsd.perforce@cyrus.watson.org)
Received: (from perforce@localhost)
	by freefall.freebsd.org (8.12.6/8.12.6/Submit) id g8MHNEd5003302
	for perforce@freebsd.org; Sun, 22 Sep 2002 10:23:14 -0700 (PDT)
Date: Sun, 22 Sep 2002 10:23:14 -0700 (PDT)
Message-Id: <200209221723.g8MHNEd5003302@freefall.freebsd.org>
X-Authentication-Warning: freefall.freebsd.org: perforce set sender to bb+lists.freebsd.perforce@cyrus.watson.org using -f
From: Robert Watson <rwatson@FreeBSD.org>
Subject: PERFORCE change 17935 for review
To: Perforce Change Reviews <perforce@freebsd.org>
Sender: owner-p4-projects@FreeBSD.ORG
Precedence: bulk
List-ID: <p4-projects.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20p4-projects>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20p4-projects>
X-Loop: FreeBSD.ORG

http://people.freebsd.org/~peter/p4db/chv.cgi?CH=17935

Change 17935 by rwatson@rwatson_paprika on 2002/09/22 10:22:33

	Teach mac_partition model that a request to set the partition to 0
	is a no-op during the relabel check (we already handled it that
	way in the actual relabel implementation).  This reduces
	interference with other loaded policies.

Affected files ...

.. //depot/projects/trustedbsd/mac/sys/security/mac_partition/mac_partition.c#13 edit

Differences ...

==== //depot/projects/trustedbsd/mac/sys/security/mac_partition/mac_partition.c#13 (text+ko) ====

@@ -196,15 +196,26 @@
 }
 
 static int
-mac_partition_check_cred_relabel(struct ucred *cred, struct mac *newlabel)
+mac_partition_check_cred_relabel(struct ucred *cred, struct label *newlabel)
 {
+	int error;
+
+	error = 0;
+
+	/* Treat "0" as a no-op request. */
+	if (SLOT(newlabel) != 0) {
+		/* If we're already in a partition, can't repartition. */
+		if (SLOT(&cred->cr_label) != 0)
+			return (EPERM);
 
-	/* If in a partition, can't re-partition. */
-	if (SLOT(&cred->cr_label) != 0)
-		return (EPERM);
+		/*
+		 * If not in a partition, must have privilege to create
+		 * one.
+		 */
+		error = suser_cred(cred, 0);
+	}
 
-	/* If not in a partition, must have privilege */
-	return (suser_cred(cred, 0));
+	return (error);
 }
 
 static int

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe p4-projects" in the body of the message