From owner-p4-projects Fri Oct 25 7:58:47 2002 Delivered-To: p4-projects@freebsd.org Received: by hub.freebsd.org (Postfix, from userid 32767) id 2547937B404; Fri, 25 Oct 2002 07:58:45 -0700 (PDT) Delivered-To: perforce@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id ADFB637B401 for ; Fri, 25 Oct 2002 07:58:44 -0700 (PDT) Received: from repoman.freebsd.org (repoman.freebsd.org [216.136.204.115]) by mx1.FreeBSD.org (Postfix) with ESMTP id 6408943E4A for ; Fri, 25 Oct 2002 07:58:44 -0700 (PDT) (envelope-from bb+lists.freebsd.perforce@cyrus.watson.org) Received: from repoman.freebsd.org (localhost [127.0.0.1]) by repoman.freebsd.org (8.12.6/8.12.6) with ESMTP id g9PEvtmV098336 for ; Fri, 25 Oct 2002 07:57:55 -0700 (PDT) (envelope-from bb+lists.freebsd.perforce@cyrus.watson.org) Received: (from perforce@localhost) by repoman.freebsd.org (8.12.6/8.12.6/Submit) id g9PEvs8m098332 for perforce@freebsd.org; Fri, 25 Oct 2002 07:57:54 -0700 (PDT) Date: Fri, 25 Oct 2002 07:57:54 -0700 (PDT) Message-Id: <200210251457.g9PEvs8m098332@repoman.freebsd.org> X-Authentication-Warning: repoman.freebsd.org: perforce set sender to bb+lists.freebsd.perforce@cyrus.watson.org using -f From: Robert Watson Subject: PERFORCE change 20121 for review To: Perforce Change Reviews Sender: owner-p4-projects@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG http://perforce.freebsd.org/chv.cgi?CH=20121 Change 20121 by rwatson@rwatson_tislabs on 2002/10/25 07:57:39 Provide mac_biba_subject_dominate_high(), a utility function to determine if the passed subject credential dominates a high object. Use only for sysctl mib entries. Affected files ... .. //depot/projects/trustedbsd/mac/sys/security/mac_biba/mac_biba.c#159 edit Differences ... ==== //depot/projects/trustedbsd/mac/sys/security/mac_biba/mac_biba.c#159 (text+ko) ==== @@ -220,6 +220,19 @@ } static int +mac_biba_subject_dominate_high(struct mac_biba *mac_biba) +{ + struct mac_biba_element *element; + + KASSERT((mac_biba->mb_single->mb_flags & MAC_BIBA_FLAG_SINGLE) != 0, + ("mac_biba_single_in_range: mac_biba not single")); + element = &mac_biba->mb_single; + + return (element->mbe_type == MAC_BIBA_TYPE_EQUAL || + element->mbe_type == MAC_BIBA_TYPE_HIGH); +} + +static int mac_biba_range_in_range(struct mac_biba *rangea, struct mac_biba *rangeb) { @@ -1873,14 +1886,19 @@ subj = SLOT(&cred->cr_label); /* - * Permit sysctl modification only if Biba-privileged; permit - * read by any process. Exempt certain management interfaces - * that are used to query MIB state. XXXMAC: This probably - * requires some more review. + * In general, treat sysctl variables as biba/high, but also + * require privilege to change them, since they are a + * communications channel between grades. Exempt MIB + * queries from this due to undocmented sysctl magic. + * XXXMAC: This probably requires some more review. */ if (new != NULL) { if (namelen > 0 && name[0] == 0) return (0); + + if (!mac_biba_subject_dominate_high(subj)) + return (EACCES); + error = mac_biba_privileged(subj); if (error) return (error); To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe p4-projects" in the body of the message