Date: Wed, 23 Oct 2002 08:39:32 -0700 (PDT) From: Robert Watson <rwatson@FreeBSD.org> To: Perforce Change Reviews <perforce@freebsd.org> Subject: PERFORCE change 19968 for review Message-ID: <200210231539.g9NFdWgq008590@repoman.freebsd.org>
next in thread | raw e-mail | index | archive | help
http://perforce.freebsd.org/chv.cgi?CH=19968 Change 19968 by rwatson@rwatson_tislabs on 2002/10/23 08:39:25 Integ mac_biba sysctl change into mac_lomac. Affected files ... .. //depot/projects/trustedbsd/mac/sys/security/mac_lomac/mac_lomac.c#14 integrate Differences ... ==== //depot/projects/trustedbsd/mac/sys/security/mac_lomac/mac_lomac.c#14 (text+ko) ==== @@ -305,6 +305,14 @@ } static int +mac_lomac_privileged(struct mac_lomac *mac_lomac) +{ + + /* Equate the notion of "equal" with privilege. */ + return (mac_lomac_subject_equal_ok(mac_lomac)); +} + +static int mac_lomac_valid(struct mac_lomac *mac_lomac) { @@ -1763,6 +1771,29 @@ } static int +mac_lomac_check_sysctl(struct ucred *cred, int *name, u_int namelen, + void *old, size_t *oldlenp, int inkernel, void *new, size_t newlen) +{ + struct mac_lomac *subj; + + if (!mac_lomac_enabled) + return (0); + + subj = SLOT(&cred->cr_label); + + /* + * Permit sysctl modification only if Biba-privileged; permit + * read by any process. + */ + if (new != NULL) { + if (!mac_lomac_privileged(subj)) + return (EPERM); + } + + return (0); +} + +static int mac_lomac_check_vnode_chdir(struct ucred *cred, struct vnode *dvp, struct label *dlabel) { @@ -2559,6 +2590,8 @@ (macop_t)mac_lomac_check_socket_relabel }, { MAC_CHECK_SOCKET_VISIBLE, (macop_t)mac_lomac_check_socket_visible }, + { MAC_CHECK_SYSCTL, + (macop_t)mac_lomac_check_sysctl }, { MAC_CHECK_VNODE_ACCESS, (macop_t)mac_lomac_check_vnode_open }, { MAC_CHECK_VNODE_CHDIR, To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe p4-projects" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200210231539.g9NFdWgq008590>