From owner-p4-projects Thu Oct 31 8: 3:20 2002 Delivered-To: p4-projects@freebsd.org Received: by hub.freebsd.org (Postfix, from userid 32767) id E5E3E37B404; Thu, 31 Oct 2002 08:03:16 -0800 (PST) Delivered-To: perforce@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 7CB3D37B401 for ; Thu, 31 Oct 2002 08:03:16 -0800 (PST) Received: from repoman.freebsd.org (repoman.freebsd.org [216.136.204.115]) by mx1.FreeBSD.org (Postfix) with ESMTP id 16A9F43E77 for ; Thu, 31 Oct 2002 08:03:16 -0800 (PST) (envelope-from bb+lists.freebsd.perforce@cyrus.watson.org) Received: from repoman.freebsd.org (localhost [127.0.0.1]) by repoman.freebsd.org (8.12.6/8.12.6) with ESMTP id g9VG1tmV089821 for ; Thu, 31 Oct 2002 08:01:55 -0800 (PST) (envelope-from bb+lists.freebsd.perforce@cyrus.watson.org) Received: (from perforce@localhost) by repoman.freebsd.org (8.12.6/8.12.6/Submit) id g9VG1sJ5089818 for perforce@freebsd.org; Thu, 31 Oct 2002 08:01:54 -0800 (PST) Date: Thu, 31 Oct 2002 08:01:54 -0800 (PST) Message-Id: <200210311601.g9VG1sJ5089818@repoman.freebsd.org> X-Authentication-Warning: repoman.freebsd.org: perforce set sender to bb+lists.freebsd.perforce@cyrus.watson.org using -f From: Robert Watson Subject: PERFORCE change 20477 for review To: Perforce Change Reviews Sender: owner-p4-projects@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG http://perforce.freebsd.org/chv.cgi?CH=20477 Change 20477 by rwatson@rwatson_tislabs on 2002/10/31 08:01:18 Add mac_check_system_settime(), a MAC Framework entry point to authorize modification of the system time. Right now, we just pass a credential; in the future, potentially it could be desirable to pass other stuff (such as the requested time change), but that introduces locking and structure complexity I'm not sure we want to deal with just now. Affected files ... .. //depot/projects/trustedbsd/mac/sys/kern/kern_mac.c#345 edit .. //depot/projects/trustedbsd/mac/sys/kern/kern_time.c#9 edit .. //depot/projects/trustedbsd/mac/sys/sys/mac.h#206 edit .. //depot/projects/trustedbsd/mac/sys/sys/mac_policy.h#162 edit Differences ... ==== //depot/projects/trustedbsd/mac/sys/kern/kern_mac.c#345 (text+ko) ==== @@ -2547,6 +2547,19 @@ } int +mac_check_system_settime(struct ucred *cred) +{ + int error; + + if (!mac_enforce_system) + return (0); + + MAC_CHECK(check_system_settime, cred); + + return (error); +} + +int mac_check_system_swapon(struct ucred *cred, struct vnode *vp) { int error; ==== //depot/projects/trustedbsd/mac/sys/kern/kern_time.c#9 (text+ko) ==== @@ -34,6 +34,8 @@ * $FreeBSD: src/sys/kern/kern_time.c,v 1.85 2002/09/25 12:00:38 bde Exp $ */ +#include "opt_mac.h" + #include #include #include @@ -42,6 +44,7 @@ #include #include #include +#include #include #include #include @@ -182,6 +185,11 @@ struct timespec ats; int error; +#ifdef MAC + error = mac_check_system_settime(td->td_ucred); + if (error) + return (error); +#endif if ((error = suser(td)) != 0) return (error); if (SCARG(uap, clock_id) != CLOCK_REALTIME) @@ -351,6 +359,11 @@ struct timezone atz; int error = 0; +#ifdef MAC + error = mac_check_system_settime(td->td_ucred); + if (error) + return (error); +#endif if ((error = suser(td))) return (error); /* Verify all parameters before changing time. */ ==== //depot/projects/trustedbsd/mac/sys/sys/mac.h#206 (text+ko) ==== @@ -266,6 +266,7 @@ int mac_check_socket_visible(struct ucred *cred, struct socket *so); int mac_check_system_acct(struct ucred *cred, struct vnode *vp); int mac_check_system_reboot(struct ucred *cred, int howto); +int mac_check_system_settime(struct ucred *cred); int mac_check_system_swapon(struct ucred *cred, struct vnode *vp); int mac_check_system_sysctl(struct ucred *cred, int *name, u_int namelen, void *old, size_t *oldlenp, int inkernel, ==== //depot/projects/trustedbsd/mac/sys/sys/mac_policy.h#162 (text+ko) ==== @@ -324,6 +324,7 @@ int (*mpo_check_system_acct)(struct ucred *cred, struct vnode *vp, struct label *vlabel); int (*mpo_check_system_reboot)(struct ucred *cred, int howto); + int (*mpo_check_system_settime)(struct ucred *cred); int (*mpo_check_system_swapon)(struct ucred *cred, struct vnode *vp, struct label *label); int (*mpo_check_system_sysctl)(struct ucred *cred, int *name, To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe p4-projects" in the body of the message