From owner-p4-projects Thu Oct 17 10:29:36 2002 Delivered-To: p4-projects@freebsd.org Received: by hub.freebsd.org (Postfix, from userid 32767) id DC1C337B40B; Thu, 17 Oct 2002 10:29:13 -0700 (PDT) Delivered-To: perforce@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id F068E37B4B9 for ; Thu, 17 Oct 2002 10:29:11 -0700 (PDT) Received: from repoman.freebsd.org (repoman.freebsd.org [216.136.204.115]) by mx1.FreeBSD.org (Postfix) with ESMTP id 2A3B043E7B for ; Thu, 17 Oct 2002 10:29:11 -0700 (PDT) (envelope-from green@freebsd.org) Received: from repoman.freebsd.org (localhost [127.0.0.1]) by repoman.freebsd.org (8.12.6/8.12.6) with ESMTP id g9HHT2mV069617 for ; Thu, 17 Oct 2002 10:29:02 -0700 (PDT) (envelope-from green@freebsd.org) Received: (from perforce@localhost) by repoman.freebsd.org (8.12.6/8.12.6/Submit) id g9HHT1Bw069614 for perforce@freebsd.org; Thu, 17 Oct 2002 10:29:01 -0700 (PDT) Date: Thu, 17 Oct 2002 10:29:01 -0700 (PDT) Message-Id: <200210171729.g9HHT1Bw069614@repoman.freebsd.org> X-Authentication-Warning: repoman.freebsd.org: perforce set sender to green@freebsd.org using -f From: Brian Feldman Subject: PERFORCE change 19467 for review To: Perforce Change Reviews Sender: owner-p4-projects@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG http://perforce.freebsd.org/chv.cgi?CH=19467 Change 19467 by green@green_laptop_2 on 2002/10/17 10:28:43 Add the (not yet documented further) execve_mac(2) system call, which allows for transitioning by SEBSD. To provide more information, including the execve_mac(2) label passed in, the struct image_params *imgp is now passed to all MAC exec entry points. Implement internalization for credential labels in SEBSD, so that execve_mac(2) works properly and setpmac(1) "sorta" works. Affected files ... .. //depot/projects/trustedbsd/mac/sys/ia64/ia32/syscalls.master#6 edit .. //depot/projects/trustedbsd/mac/sys/kern/imgact_elf.c#15 edit .. //depot/projects/trustedbsd/mac/sys/kern/init_sysent.c#38 edit .. //depot/projects/trustedbsd/mac/sys/kern/kern_exec.c#38 edit .. //depot/projects/trustedbsd/mac/sys/kern/kern_mac.c#312 edit .. //depot/projects/trustedbsd/mac/sys/kern/syscalls.c#37 edit .. //depot/projects/trustedbsd/mac/sys/kern/syscalls.master#34 edit .. //depot/projects/trustedbsd/mac/sys/security/mac_biba/mac_biba.c#134 edit .. //depot/projects/trustedbsd/mac/sys/security/mac_bsdextended/mac_bsdextended.c#56 edit .. //depot/projects/trustedbsd/mac/sys/security/mac_mls/mac_mls.c#114 edit .. //depot/projects/trustedbsd/mac/sys/security/mac_none/mac_none.c#85 edit .. //depot/projects/trustedbsd/mac/sys/security/mac_te/mac_te.c#87 edit .. //depot/projects/trustedbsd/mac/sys/security/mac_test/mac_test.c#58 edit .. //depot/projects/trustedbsd/mac/sys/security/sebsd/sebsd.c#42 edit .. //depot/projects/trustedbsd/mac/sys/sys/exec.h#3 edit .. //depot/projects/trustedbsd/mac/sys/sys/imgact.h#12 edit .. //depot/projects/trustedbsd/mac/sys/sys/mac.h#180 edit .. //depot/projects/trustedbsd/mac/sys/sys/mac_policy.h#141 edit .. //depot/projects/trustedbsd/mac/sys/sys/syscall.h#38 edit .. //depot/projects/trustedbsd/mac/sys/sys/syscall.mk#37 edit .. //depot/projects/trustedbsd/mac/sys/sys/sysproto.h#39 edit Differences ... ==== //depot/projects/trustedbsd/mac/sys/ia64/ia32/syscalls.master#6 (text+ko) ==== @@ -585,3 +585,4 @@ 412 UNIMPL BSD extattr_set_link 413 UNIMPL BSD extattr_get_link 414 UNIMPL BSD extattr_delete_link +415 UNIMPL BSD execve_mac ==== //depot/projects/trustedbsd/mac/sys/kern/imgact_elf.c#15 (text+ko) ==== @@ -519,6 +519,7 @@ imgp->firstpage = NULL; imgp->image_header = (char *)kmem_alloc_wait(exec_map, PAGE_SIZE); imgp->object = NULL; + imgp->execlabel = NULL; if (imgp->image_header == NULL) { nd->ni_vp = NULL; ==== //depot/projects/trustedbsd/mac/sys/kern/init_sysent.c#38 (text+ko) ==== @@ -443,4 +443,5 @@ { AS(extattr_set_link_args), (sy_call_t *)extattr_set_link }, /* 412 = extattr_set_link */ { AS(extattr_get_link_args), (sy_call_t *)extattr_get_link }, /* 413 = extattr_get_link */ { AS(extattr_delete_link_args), (sy_call_t *)extattr_delete_link }, /* 414 = extattr_delete_link */ + { SYF_MPSAFE | AS(execve_mac_args), (sy_call_t *)execve_mac }, /* 415 = execve_mac */ }; ==== //depot/projects/trustedbsd/mac/sys/kern/kern_exec.c#38 (text+ko) ==== @@ -136,22 +136,23 @@ static const struct execsw **execsw; #ifndef _SYS_SYSPROTO_H_ -struct execve_args { +struct execve_mac_args { char *fname; char **argv; char **envv; + struct mac *mac_p; }; #endif /* - * execve() system call. + * execve_mac() system call. * * MPSAFE */ int -execve(td, uap) +execve_mac(td, uap) struct thread *td; - register struct execve_args *uap; + register struct execve_mac_args *uap; { struct proc *p = td->td_proc; struct nameidata nd, *ndp; @@ -172,6 +173,7 @@ int textset; #ifdef MAC struct label interplabel; /* label of the interpreted file */ + struct label execlabel; /* additional MAC label argument */ int will_transition, interplabelvalid = 0; #endif @@ -208,6 +210,7 @@ */ imgp->proc = p; imgp->uap = uap; + imgp->execlabel = NULL; imgp->attr = &attr; imgp->argc = imgp->envc = 0; imgp->argv0 = NULL; @@ -222,6 +225,14 @@ imgp->ps_strings = 0; imgp->auxarg_size = 0; +#ifdef MAC + error = mac_execve_enter(imgp, uap->mac_p, &execlabel); + if (error) { + mtx_lock(&Giant); + goto exec_fail; + } +#endif /* MAC */ + /* * Allocate temporary demand zeroed space for argument and * environment strings @@ -458,7 +469,7 @@ #ifdef MAC will_transition = mac_execve_will_transition(oldcred, imgp->vp, - interplabelvalid ? &interplabel : NULL); + interplabelvalid ? &interplabel : NULL, imgp); credential_changing |= will_transition; #endif @@ -506,7 +517,7 @@ #ifdef MAC if (will_transition) { mac_execve_transition(oldcred, newcred, imgp->vp, - interplabelvalid ? &interplabel : NULL); + interplabelvalid ? &interplabel : NULL, imgp); } #endif /* @@ -653,12 +664,18 @@ if (imgp->vmspace_destroyed) { /* sorry, no more process anymore. exit gracefully */ +#ifdef MAC + mac_execve_exit(imgp); + if (interplabelvalid) + mac_destroy_vnode_label(&interplabel); +#endif /* MAC */ exit1(td, W_EXITCODE(0, SIGABRT)); /* NOT REACHED */ error = 0; } done2: #ifdef MAC + mac_execve_exit(imgp); if (interplabelvalid) mac_destroy_vnode_label(&interplabel); #endif /* MAC */ @@ -666,7 +683,31 @@ return (error); } +/* + * execve() system call. This is simply a wrapper for execve_mac + * which passes in a NULL label argument. + * + * MPSAFE + */ int +execve(td, uap) + struct thread *td; + struct execve_args /* { + syscallarg(char *) fname; + syscallarg(char **) argv; + syscallarg(char **) envv; + } */ *uap; +{ + struct execve_mac_args mac_args; + + mac_args.fname = uap->fname; + mac_args.argv = uap->argv; + mac_args.envv = uap->envv; + mac_args.mac_p = NULL; + return (execve_mac(td, &mac_args)); +} + +int exec_map_first_page(imgp) struct image_params *imgp; { @@ -1027,7 +1068,7 @@ td = curthread; /* XXXKSE */ #ifdef MAC - error = mac_check_vnode_exec(td->td_ucred, imgp->vp); + error = mac_check_vnode_exec(td->td_ucred, imgp->vp, imgp); if (error) return (error); #endif ==== //depot/projects/trustedbsd/mac/sys/kern/kern_mac.c#312 (text+ko) ==== @@ -50,6 +50,7 @@ #include #include +#include #include #include #include @@ -2058,12 +2059,14 @@ void mac_execve_transition(struct ucred *old, struct ucred *new, struct vnode *vp, - struct label *shelllabel) + struct label *shelllabel, struct image_params *imgp) { int error; ASSERT_VOP_LOCKED(vp, "mac_execve_transition"); + if (!mac_enforce_process && !mac_enforce_fs) + return; error = vn_refreshlabel(vp, old); if (error) { printf("mac_execve_transition: vn_refreshlabel returned %d\n", @@ -2071,22 +2074,26 @@ printf("mac_execve_transition: using old vnode label\n"); } - MAC_PERFORM(execve_transition, old, new, vp, &vp->v_label, shelllabel); + MAC_PERFORM(execve_transition, old, new, vp, &vp->v_label, shelllabel, + imgp); } int mac_execve_will_transition(struct ucred *old, struct vnode *vp, - struct label *shelllabel) + struct label *shelllabel, struct image_params *imgp) { int error, result; + if (!mac_enforce_process && !mac_enforce_fs) + return (0); + error = vn_refreshlabel(vp, old); if (error) return (error); result = 0; MAC_BOOLEAN(execve_will_transition, ||, old, vp, &vp->v_label, - shelllabel); + shelllabel, imgp); return (result); } @@ -2208,7 +2215,8 @@ } int -mac_check_vnode_exec(struct ucred *cred, struct vnode *vp) +mac_check_vnode_exec(struct ucred *cred, struct vnode *vp, + struct image_params *imgp) { int error; @@ -2220,7 +2228,7 @@ error = vn_refreshlabel(vp, cred); if (error) return (error); - MAC_CHECK(check_vnode_exec, cred, vp, &vp->v_label); + MAC_CHECK(check_vnode_exec, cred, vp, &vp->v_label, imgp); return (error); } @@ -4256,6 +4264,41 @@ return (error); } +int +mac_execve_enter(struct image_params *imgp, struct mac *mac_p, + struct label *execlabelstorage) +{ + struct mac_element *element_array; + struct mac extmac; + int error; + + if (mac_p == NULL) + return (0); + error = copyin(mac_p, &extmac, sizeof(extmac)); + if (error) + return (error); + error = mac_copyin_element_array(&extmac, &element_array); + if (error) + return (error); + mac_init_cred_label(execlabelstorage); + error = mac_internalize_cred_label(execlabelstorage, &extmac, + element_array); + mac_free_element_array(element_array); + if (error) { + mac_destroy_cred_label(execlabelstorage); + return (error); + } + imgp->execlabel = execlabelstorage; + return (error); +} + +void +mac_execve_exit(struct image_params *imgp) +{ + if (imgp->execlabel != NULL) + mac_destroy_cred_label(imgp->execlabel); +} + SYSINIT(mac, SI_SUB_MAC, SI_ORDER_FIRST, mac_init, NULL); SYSINIT(mac_late, SI_SUB_MAC_LATE, SI_ORDER_FIRST, mac_late_init, NULL); @@ -4331,4 +4374,16 @@ return (ENOSYS); } +int +mac_execve_enter(struct image_params *imgp, struct mac *mac_p, + struct label *execlabelstorage) +{ + + return (0); +} + +void +mac_execve_exit(struct image_params *imgp) +{ +} #endif /* !MAC */ ==== //depot/projects/trustedbsd/mac/sys/kern/syscalls.c#37 (text+ko) ==== @@ -2,8 +2,8 @@ * System call names. * * DO NOT EDIT-- this file is automatically generated. - * $FreeBSD: src/sys/kern/syscalls.c,v 1.122 2002/10/10 04:08:11 rwatson Exp $ - * created from FreeBSD: src/sys/kern/syscalls.master,v 1.128 2002/10/10 04:02:49 rwatson Exp + * $FreeBSD$ + * created from FreeBSD: src/sys/kern/syscalls.master,v 1.129 2002/10/15 01:36:45 peter Exp */ char *syscallnames[] = { @@ -416,10 +416,11 @@ "ksem_unlink", /* 406 = ksem_unlink */ "ksem_getvalue", /* 407 = ksem_getvalue */ "ksem_destroy", /* 408 = ksem_destroy */ - "#409", /* 409 = __mac_get_pid */ - "#410", /* 410 = __mac_get_link */ - "#411", /* 411 = __mac_set_link */ + "__mac_get_pid", /* 409 = __mac_get_pid */ + "__mac_get_link", /* 410 = __mac_get_link */ + "__mac_set_link", /* 411 = __mac_set_link */ "extattr_set_link", /* 412 = extattr_set_link */ "extattr_get_link", /* 413 = extattr_get_link */ "extattr_delete_link", /* 414 = extattr_delete_link */ + "execve_mac", /* 415 = execve_mac */ }; ==== //depot/projects/trustedbsd/mac/sys/kern/syscalls.master#34 (text+ko) ==== @@ -597,6 +597,8 @@ void *data, size_t nbytes); } 414 STD BSD { int extattr_delete_link(const char *path, \ int attrnamespace, const char *attrname); } +415 MSTD BSD { int execve_mac(char *fname, char **argv, \ + char **envv, struct mac *mac_p); } ; Please copy any additions and changes to the following compatability tables: ; sys/ia64/ia32/syscalls.master (take a best guess) ==== //depot/projects/trustedbsd/mac/sys/security/mac_biba/mac_biba.c#134 (text+ko) ==== @@ -1236,7 +1236,8 @@ static void mac_biba_execve_transition(struct ucred *old, struct ucred *new, - struct vnode *vp, struct mac *vnodelabel, struct mac *shellvnodelabel) + struct vnode *vp, struct mac *vnodelabel, struct mac *shellvnodelabel, + struct image_params *imgp) { struct mac_biba *source, *dest; @@ -1249,7 +1250,8 @@ static int mac_biba_execve_will_transition(struct ucred *old, struct vnode *vp, - struct mac *vnodelabel, struct vnode *shellvnodelabel) + struct mac *vnodelabel, struct vnode *shellvnodelabel, + struct image_params *imgp) { return (0); @@ -1827,7 +1829,7 @@ static int mac_biba_check_vnode_exec(struct ucred *cred, struct vnode *vp, - struct label *label) + struct label *label, struct image_params *imgp) { struct mac_biba *subj, *obj; ==== //depot/projects/trustedbsd/mac/sys/security/mac_bsdextended/mac_bsdextended.c#56 (text+ko) ==== @@ -397,7 +397,7 @@ static int mac_bsdextended_check_vnode_exec(struct ucred *cred, struct vnode *vp, - struct label *label) + struct label *label, struct image_params *imgp) { struct vattr vap; int error; ==== //depot/projects/trustedbsd/mac/sys/security/mac_mls/mac_mls.c#114 (text+ko) ==== @@ -1278,7 +1278,8 @@ static void mac_mls_execve_transition(struct ucred *old, struct ucred *new, - struct vnode *vp, struct label *vnodelabel, struct label *shellvnodelabel) + struct vnode *vp, struct label *vnodelabel, struct label *shellvnodelabel, + struct image_params *imgp) { struct mac_mls *source, *dest; @@ -1291,7 +1292,8 @@ static int mac_mls_execve_will_transition(struct ucred *old, struct vnode *vp, - struct label *vnodelabel, struct label *shellvnodelabel) + struct label *vnodelabel, struct label *shellvnodelabel, + struct image_params *imgp) { return (0); @@ -1878,7 +1880,7 @@ static int mac_mls_check_vnode_exec(struct ucred *cred, struct vnode *vp, - struct label *label) + struct label *label, struct image_params *imgp) { struct mac_mls *subj, *obj; ==== //depot/projects/trustedbsd/mac/sys/security/mac_none/mac_none.c#85 (text+ko) ==== @@ -415,14 +415,16 @@ static void mac_none_execve_transition(struct ucred *old, struct ucred *new, - struct vnode *vp, struct label *vnodelabel, struct label *shellvnodelabel) + struct vnode *vp, struct label *vnodelabel, struct label *shellvnodelabel, + struct image_params *imgp) { } static int mac_none_execve_will_transition(struct ucred *old, struct vnode *vp, - struct label *vnodelabel, struct label *shellvnodelabel) + struct label *vnodelabel, struct label *shellvnodelabel, + struct image_params *imgp) { return (0); @@ -669,7 +671,7 @@ static int mac_none_check_vnode_exec(struct ucred *cred, struct vnode *vp, - struct label *label) + struct label *label, struct image_params *imgp) { return (0); ==== //depot/projects/trustedbsd/mac/sys/security/mac_te/mac_te.c#87 (text+ko) ==== @@ -1097,7 +1097,7 @@ static int mac_te_check_exec_vnode(struct ucred *cred, struct vnode *vp, - struct label *label) + struct label *label, struct image_params *imgp) { return (mac_te_check(&cred->cr_label, label, MAC_TE_CLASS_FILE, @@ -1534,7 +1534,8 @@ static void mac_te_execve_transition(struct ucred *old, struct ucred *new, - struct vnode *vp, struct label *filelabel, struct label *shellfilelabel) + struct vnode *vp, struct label *filelabel, struct label *shellfilelabel, + struct image_params *imgp) { int rule; @@ -1566,7 +1567,8 @@ static int mac_te_execve_will_transition(struct ucred *old, struct vnode *vp, - struct label *filelabel, struct label *shellfilelabel) + struct label *filelabel, struct label *shellfilelabel, + struct image_params *imgp) { int rule; ==== //depot/projects/trustedbsd/mac/sys/security/mac_test/mac_test.c#58 (text+ko) ==== @@ -794,14 +794,16 @@ static void mac_test_execve_transition(struct ucred *old, struct ucred *new, - struct vnode *vp, struct label *filelabel, struct label *shellfilelabel) + struct vnode *vp, struct label *filelabel, struct label *shellfilelabel, + struct image_params *imgp) { } static int mac_test_execve_will_transition(struct ucred *old, struct vnode *vp, - struct label *filelabel, struct label *shellfilelabel) + struct label *filelabel, struct label *shellfilelabel, + struct image_params *imgp) { return (0); @@ -1065,7 +1067,7 @@ static int mac_test_check_vnode_exec(struct ucred *cred, struct vnode *vp, - struct label *label) + struct label *label, struct image_params *imgp) { return (0); ==== //depot/projects/trustedbsd/mac/sys/security/sebsd/sebsd.c#42 (text+ko) ==== @@ -37,6 +37,7 @@ #include #include #include +#include #include #include #include @@ -298,11 +299,11 @@ static void sebsd_execve_transition(struct ucred *old, struct ucred *new, struct vnode *vp, struct label *vnodelabel, - struct label *shellvnodelabel) + struct label *shellvnodelabel, + struct image_params *imgp) { struct task_security_struct *otask, *ntask; struct vnode_security_struct *file; - int rc; otask = SLOT(&old->cr_label); ntask = SLOT(&new->cr_label); @@ -317,10 +318,13 @@ * So just make the transition. */ ntask->osid = otask->sid; - rc = security_transition_sid(otask->sid, file->sid, SECCLASS_PROCESS, - &ntask->sid); - if (rc) - return; /* TBD: what happens if the previous call failed? */ + if (imgp->execlabel == NULL) { + (void)security_transition_sid(otask->sid, file->sid, + SECCLASS_PROCESS, &ntask->sid); + } else { + ntask->sid = ((struct task_security_struct *) + SLOT(imgp->execlabel))->sid; + } if (otask->sid != ntask->sid) { /* @@ -336,12 +340,12 @@ static int sebsd_execve_will_transition(struct ucred *old, struct vnode *vp, struct label *vnodelabel, - struct label *shellvnodelabel) + struct label *shellvnodelabel, + struct image_params *imgp) { struct task_security_struct *task; struct vnode_security_struct *file; security_id_t newsid; - int rc; task = SLOT(&old->cr_label); if (shellvnodelabel != NULL) @@ -353,10 +357,13 @@ * Should have already checked all the permissions, so just see if * the SIDS are going to match. */ - rc = security_transition_sid(task->sid, file->sid, SECCLASS_PROCESS, - &newsid); - if (rc) - return EACCES; + if (imgp->execlabel == NULL) { + (void)security_transition_sid(task->sid, file->sid, + SECCLASS_PROCESS, &newsid); + } else { + newsid = ((struct task_security_struct *) + SLOT(imgp->execlabel))->sid; + } return (newsid != task->sid); } @@ -487,12 +494,11 @@ } static int -sebsd_internalize_vnode_label(struct label *label, struct mac *mac, - struct mac_element *element, int *claimed) +sebsd_internalize_sid(security_id_t *sidp, struct mac_element *element, + int *claimed) { char context[128]; size_t context_len; - struct vnode_security_struct *vsec; int error; if (strcmp("sebsd", element->me_name) != 0) @@ -504,8 +510,27 @@ &context_len); if (error) return (error); + return (security_context_to_sid(context, context_len, sidp)); +} + +static int +sebsd_internalize_cred_label(struct label *label, struct mac *mac, + struct mac_element *element, int *claimed) +{ + struct task_security_struct *tsec; + + tsec = SLOT(label); + return (sebsd_internalize_sid(&tsec->sid, element, claimed)); +} + +static int +sebsd_internalize_vnode_label(struct label *label, struct mac *mac, + struct mac_element *element, int *claimed) +{ + struct vnode_security_struct *vsec; + vsec = SLOT(label); - return (security_context_to_sid(context, context_len, &vsec->sid)); + return (sebsd_internalize_sid(&vsec->sid, element, claimed)); } static void @@ -675,7 +700,7 @@ static int sebsd_check_vnode_exec(struct ucred *cred, struct vnode *vp, - struct label *label) + struct label *label, struct image_params *imgp) { struct task_security_struct *task; struct vnode_security_struct *file; @@ -684,10 +709,15 @@ task = SLOT(&cred->cr_label); file = SLOT(label); - rc = security_transition_sid(task->sid, file->sid, SECCLASS_PROCESS, - &newsid); - if (rc) - return EACCES; + if (imgp->execlabel == NULL) { + rc = security_transition_sid(task->sid, file->sid, + SECCLASS_PROCESS, &newsid); + if (rc) + return EACCES; + } else { + newsid = ((struct task_security_struct *) + SLOT(imgp->execlabel))->sid; + } if (newsid == task->sid) { rc = avc_has_perm(task->sid, file->sid, @@ -1128,6 +1158,7 @@ /* In/Out */ { MAC_EXTERNALIZE_CRED_LABEL, sebsd_externalize_cred_label }, { MAC_EXTERNALIZE_VNODE_LABEL, sebsd_externalize_vnode_label }, + { MAC_INTERNALIZE_CRED_LABEL, sebsd_internalize_cred_label }, { MAC_INTERNALIZE_VNODE_LABEL, sebsd_internalize_vnode_label }, /* Create Labels */ ==== //depot/projects/trustedbsd/mac/sys/sys/exec.h#3 (text+ko) ==== ==== //depot/projects/trustedbsd/mac/sys/sys/imgact.h#12 (text+ko) ==== @@ -41,10 +41,12 @@ struct sysentvec; struct thread; struct vm_object; +struct label; struct image_params { struct proc *proc; /* our process struct */ - struct execve_args *uap; /* syscall arguments */ + struct execve_mac_args *uap; /* syscall arguments */ + struct label *execlabel; /* MAC label to compose transition with */ struct vnode *vp; /* pointer to vnode of file to exec */ struct vm_object *object; /* The vm object for this vp */ struct vattr *attr; /* attributes of file */ ==== //depot/projects/trustedbsd/mac/sys/sys/mac.h#180 (text+ko) ==== @@ -207,6 +207,7 @@ struct ifnet; struct ifreq; struct ipq; +struct image_params; struct mbuf; struct mount; struct proc; @@ -311,9 +312,13 @@ */ void mac_create_cred(struct ucred *cred_parent, struct ucred *cred_child); void mac_execve_transition(struct ucred *old, struct ucred *new, - struct vnode *vp, struct label *shelllabel); + struct vnode *vp, struct label *shelllabel, + struct image_params *imgp); int mac_execve_will_transition(struct ucred *old, struct vnode *vp, - struct label *shelllabel); + struct label *shelllabel, struct image_params *imgp); +int mac_execve_enter(struct image_params *imgp, struct mac *mac_p, + struct label *execlabel); +void mac_execve_exit(struct image_params *imgp); void mac_create_proc0(struct ucred *cred); void mac_create_proc1(struct ucred *cred); void mac_thread_userret(struct thread *td); @@ -352,7 +357,8 @@ struct vnode *vp, struct componentname *cnp); int mac_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp, acl_type_t type); -int mac_check_vnode_exec(struct ucred *cred, struct vnode *vp); +int mac_check_vnode_exec(struct ucred *cred, struct vnode *vp, + struct image_params *imgp); int mac_check_vnode_getacl(struct ucred *cred, struct vnode *vp, acl_type_t type); int mac_check_vnode_getextattr(struct ucred *cred, struct vnode *vp, ==== //depot/projects/trustedbsd/mac/sys/sys/mac_policy.h#141 (text+ko) ==== @@ -252,10 +252,12 @@ struct ucred *child_cred); void (*mpo_execve_transition)(struct ucred *old, struct ucred *new, struct vnode *vp, struct label *vnodelabel, - struct label *shellvnodelabel); + struct label *shellvnodelabel, + struct image_params *imgp); int (*mpo_execve_will_transition)(struct ucred *old, struct vnode *vp, struct label *vnodelabel, - struct label *shellvnodelabel); + struct label *shellvnodelabel, + struct image_params *imgp); void (*mpo_create_proc0)(struct ucred *cred); void (*mpo_create_proc1)(struct ucred *cred); void (*mpo_relabel_cred)(struct ucred *cred, @@ -333,7 +335,7 @@ int (*mpo_check_vnode_deleteacl)(struct ucred *cred, struct vnode *vp, struct label *label, acl_type_t type); int (*mpo_check_vnode_exec)(struct ucred *cred, struct vnode *vp, - struct label *label); + struct label *label, struct image_params *imgp); int (*mpo_check_vnode_getacl)(struct ucred *cred, struct vnode *vp, struct label *label, acl_type_t type); int (*mpo_check_vnode_getextattr)(struct ucred *cred, ==== //depot/projects/trustedbsd/mac/sys/sys/syscall.h#38 (text+ko) ==== @@ -323,4 +323,5 @@ #define SYS_extattr_set_link 412 #define SYS_extattr_get_link 413 #define SYS_extattr_delete_link 414 -#define SYS_MAXSYSCALL 415 +#define SYS_execve_mac 415 +#define SYS_MAXSYSCALL 416 ==== //depot/projects/trustedbsd/mac/sys/sys/syscall.mk#37 (text+ko) ==== @@ -271,4 +271,5 @@ __mac_set_link.o \ extattr_set_link.o \ extattr_get_link.o \ - extattr_delete_link.o + extattr_delete_link.o \ + execve_mac.o ==== //depot/projects/trustedbsd/mac/sys/sys/sysproto.h#39 (text+ko) ==== @@ -1189,6 +1189,12 @@ char attrnamespace_l_[PADL_(int)]; int attrnamespace; char attrnamespace_r_[PADR_(int)]; char attrname_l_[PADL_(const char *)]; const char * attrname; char attrname_r_[PADR_(const char *)]; }; +struct execve_mac_args { + char fname_l_[PADL_(char *)]; char * fname; char fname_r_[PADR_(char *)]; + char argv_l_[PADL_(char **)]; char ** argv; char argv_r_[PADR_(char **)]; + char envv_l_[PADL_(char **)]; char ** envv; char envv_r_[PADR_(char **)]; + char mac_p_l_[PADL_(struct mac *)]; struct mac * mac_p; char mac_p_r_[PADR_(struct mac *)]; +}; int nosys(struct thread *, struct nosys_args *); void sys_exit(struct thread *, struct sys_exit_args *); int fork(struct thread *, struct fork_args *); @@ -1457,6 +1463,7 @@ int extattr_set_link(struct thread *, struct extattr_set_link_args *); int extattr_get_link(struct thread *, struct extattr_get_link_args *); int extattr_delete_link(struct thread *, struct extattr_delete_link_args *); +int execve_mac(struct thread *, struct execve_mac_args *); #ifdef COMPAT_43 To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe p4-projects" in the body of the message